From 1d17f744c7fc351c6163d4e1a9862bef78a632d5 Mon Sep 17 00:00:00 2001 From: hselasky Date: Thu, 30 Oct 2014 08:04:48 +0000 Subject: MFC r273733, r273740 and r273773: The SYSCTL data pointers can come from userspace and must not be directly accessed. Although this will work on some platforms, it can throw an exception if the pointer is invalid and then panic the kernel. Add a missing SYSCTL_IN() of "SCTP_BASE_STATS" structure. Sponsored by: Mellanox Technologies --- sys/net/bpf.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) (limited to 'sys/net/bpf.c') diff --git a/sys/net/bpf.c b/sys/net/bpf.c index cb3ed27..93929da 100644 --- a/sys/net/bpf.c +++ b/sys/net/bpf.c @@ -2755,7 +2755,8 @@ bpfstats_fill_xbpf(struct xbpf_d *d, struct bpf_d *bd) static int bpf_stats_sysctl(SYSCTL_HANDLER_ARGS) { - struct xbpf_d *xbdbuf, *xbd, zerostats; + static const struct xbpf_d zerostats; + struct xbpf_d *xbdbuf, *xbd, tempstats; int index, error; struct bpf_if *bp; struct bpf_d *bd; @@ -2775,11 +2776,13 @@ bpf_stats_sysctl(SYSCTL_HANDLER_ARGS) * as we aren't allowing the user to set the counters currently. */ if (req->newptr != NULL) { - if (req->newlen != sizeof(zerostats)) + if (req->newlen != sizeof(tempstats)) return (EINVAL); - bzero(&zerostats, sizeof(zerostats)); - xbd = req->newptr; - if (bcmp(xbd, &zerostats, sizeof(*xbd)) != 0) + memset(&tempstats, 0, sizeof(tempstats)); + error = SYSCTL_IN(req, &tempstats, sizeof(tempstats)); + if (error) + return (error); + if (bcmp(&tempstats, &zerostats, sizeof(tempstats)) != 0) return (EINVAL); bpf_zero_counters(); return (0); -- cgit v1.1