diff options
| author | green <green@FreeBSD.org> | 2000-07-02 08:08:09 +0000 |
|---|---|---|
| committer | green <green@FreeBSD.org> | 2000-07-02 08:08:09 +0000 |
| commit | 9707bc34b009d1e09d192ec84d1ddc8e8693006f (patch) | |
| tree | 176c788b7d732a310aa42a0b4652b645bc735a99 /sys/kern/uipc_syscalls.c | |
| parent | c350a86095dd249ad9e0371c7caaf6a5c52a0260 (diff) | |
| download | FreeBSD-src-9707bc34b009d1e09d192ec84d1ddc8e8693006f.zip FreeBSD-src-9707bc34b009d1e09d192ec84d1ddc8e8693006f.tar.gz | |
Modify ktrace's general I/O tracing, ktrgenio(), to use a struct uio *
instead of a struct iovec * array and int len. Get rid of stupidly trying
to allocate all of the memory and copyin()ing the entire iovec[], and
instead just do the proper VOP_WRITE() in ktrwrite() using a copy of
the struct uio that the syscall originally used.
This solves the DoS which could easily be performed; to work around the
DoS, one could also remove "options KTRACE" from the kernel. This is
a very strong MFC candidate for 4.1.
Found by: art@OpenBSD.org
Diffstat (limited to 'sys/kern/uipc_syscalls.c')
| -rw-r--r-- | sys/kern/uipc_syscalls.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c index 480b8dc..5ba2a24 100644 --- a/sys/kern/uipc_syscalls.c +++ b/sys/kern/uipc_syscalls.c @@ -451,6 +451,7 @@ sendit(p, s, mp, flags) struct socket *so; #ifdef KTRACE struct iovec *ktriov = NULL; + struct uio ktruio; #endif error = getsock(p->p_fd, s, &fp); @@ -511,6 +512,7 @@ sendit(p, s, mp, flags) MALLOC(ktriov, struct iovec *, iovlen, M_TEMP, M_WAITOK); bcopy((caddr_t)auio.uio_iov, (caddr_t)ktriov, iovlen); + ktruio = auio; } #endif len = auio.uio_resid; @@ -528,9 +530,11 @@ sendit(p, s, mp, flags) p->p_retval[0] = len - auio.uio_resid; #ifdef KTRACE if (ktriov != NULL) { - if (error == 0) - ktrgenio(p->p_tracep, s, UIO_WRITE, - ktriov, p->p_retval[0], error); + if (error == 0) { + ktruio.uio_iov = ktriov; + ktruio.uio_resid = p->p_retval[0]; + ktrgenio(p->p_tracep, s, UIO_WRITE, &ktruio, error); + } FREE(ktriov, M_TEMP); } #endif @@ -688,6 +692,7 @@ recvit(p, s, mp, namelenp) struct sockaddr *fromsa = 0; #ifdef KTRACE struct iovec *ktriov = NULL; + struct uio ktruio; #endif error = getsock(p->p_fd, s, &fp); @@ -711,6 +716,7 @@ recvit(p, s, mp, namelenp) MALLOC(ktriov, struct iovec *, iovlen, M_TEMP, M_WAITOK); bcopy((caddr_t)auio.uio_iov, (caddr_t)ktriov, iovlen); + ktruio = auio; } #endif len = auio.uio_resid; @@ -725,9 +731,11 @@ recvit(p, s, mp, namelenp) } #ifdef KTRACE if (ktriov != NULL) { - if (error == 0) - ktrgenio(p->p_tracep, s, UIO_READ, - ktriov, len - auio.uio_resid, error); + if (error == 0) { + ktruio.uio_iov = ktriov; + ktruio.uio_resid = len - auio.uio_resid; + ktrgenio(p->p_tracep, s, UIO_READ, &ktruio, error); + } FREE(ktriov, M_TEMP); } #endif |
