From 9707bc34b009d1e09d192ec84d1ddc8e8693006f Mon Sep 17 00:00:00 2001 From: green Date: Sun, 2 Jul 2000 08:08:09 +0000 Subject: Modify ktrace's general I/O tracing, ktrgenio(), to use a struct uio * instead of a struct iovec * array and int len. Get rid of stupidly trying to allocate all of the memory and copyin()ing the entire iovec[], and instead just do the proper VOP_WRITE() in ktrwrite() using a copy of the struct uio that the syscall originally used. This solves the DoS which could easily be performed; to work around the DoS, one could also remove "options KTRACE" from the kernel. This is a very strong MFC candidate for 4.1. Found by: art@OpenBSD.org --- sys/kern/uipc_syscalls.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) (limited to 'sys/kern/uipc_syscalls.c') diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c index 480b8dc..5ba2a24 100644 --- a/sys/kern/uipc_syscalls.c +++ b/sys/kern/uipc_syscalls.c @@ -451,6 +451,7 @@ sendit(p, s, mp, flags) struct socket *so; #ifdef KTRACE struct iovec *ktriov = NULL; + struct uio ktruio; #endif error = getsock(p->p_fd, s, &fp); @@ -511,6 +512,7 @@ sendit(p, s, mp, flags) MALLOC(ktriov, struct iovec *, iovlen, M_TEMP, M_WAITOK); bcopy((caddr_t)auio.uio_iov, (caddr_t)ktriov, iovlen); + ktruio = auio; } #endif len = auio.uio_resid; @@ -528,9 +530,11 @@ sendit(p, s, mp, flags) p->p_retval[0] = len - auio.uio_resid; #ifdef KTRACE if (ktriov != NULL) { - if (error == 0) - ktrgenio(p->p_tracep, s, UIO_WRITE, - ktriov, p->p_retval[0], error); + if (error == 0) { + ktruio.uio_iov = ktriov; + ktruio.uio_resid = p->p_retval[0]; + ktrgenio(p->p_tracep, s, UIO_WRITE, &ktruio, error); + } FREE(ktriov, M_TEMP); } #endif @@ -688,6 +692,7 @@ recvit(p, s, mp, namelenp) struct sockaddr *fromsa = 0; #ifdef KTRACE struct iovec *ktriov = NULL; + struct uio ktruio; #endif error = getsock(p->p_fd, s, &fp); @@ -711,6 +716,7 @@ recvit(p, s, mp, namelenp) MALLOC(ktriov, struct iovec *, iovlen, M_TEMP, M_WAITOK); bcopy((caddr_t)auio.uio_iov, (caddr_t)ktriov, iovlen); + ktruio = auio; } #endif len = auio.uio_resid; @@ -725,9 +731,11 @@ recvit(p, s, mp, namelenp) } #ifdef KTRACE if (ktriov != NULL) { - if (error == 0) - ktrgenio(p->p_tracep, s, UIO_READ, - ktriov, len - auio.uio_resid, error); + if (error == 0) { + ktruio.uio_iov = ktriov; + ktruio.uio_resid = len - auio.uio_resid; + ktrgenio(p->p_tracep, s, UIO_READ, &ktruio, error); + } FREE(ktriov, M_TEMP); } #endif -- cgit v1.1