sys/contrib/ipfilter/netinet/ip_frag.c

@@ -112,7 +112,7 @@ static void ipf_frag_free __P((ipf_frag_softc_t *, ipfr_t *));
 
 static frentry_t ipfr_block;
 
-const ipftuneable_t ipf_tuneables[] = {
+static ipftuneable_t ipf_frag_tuneables[] = {
 	{ { (void *)offsetof(ipf_frag_softc_t, ipfr_size) },
 		"frag_size",		1,	0x7fffffff,
 		stsizeof(ipf_frag_softc_t, ipfr_size),
@@ -189,6 +189,18 @@ ipf_frag_soft_create(softc)
 	RWLOCK_INIT(&softf->ipfr_frag, "ipf fragment rwlock");
 	RWLOCK_INIT(&softf->ipfr_natfrag, "ipf NAT fragment rwlock");
 
+	softf->ipf_frag_tune = ipf_tune_array_copy(softf,
+						   sizeof(ipf_frag_tuneables),
+						   ipf_frag_tuneables);
+	if (softf->ipf_frag_tune == NULL) {
+		ipf_frag_soft_destroy(softc, softf);
+		return NULL;
+	}
+	if (ipf_tune_array_link(softc, softf->ipf_frag_tune) == -1) {
+		ipf_frag_soft_destroy(softc, softf);
+		return NULL;
+	}
+
 	softf->ipfr_size = IPFT_SIZE;
 	softf->ipfr_ttl = IPF_TTLVAL(60);
 	softf->ipfr_lock = 1;
@@ -219,6 +231,13 @@ ipf_frag_soft_destroy(softc, arg)
 	RW_DESTROY(&softf->ipfr_frag);
 	RW_DESTROY(&softf->ipfr_natfrag);
 
+	if (softf->ipf_frag_tune != NULL) {
+		ipf_tune_array_unlink(softc, softf->ipf_frag_tune);
+		KFREES(softf->ipf_frag_tune, sizeof(ipf_frag_tuneables));
+		softf->ipf_frag_tune = NULL;
+	}
+
+
 	KFREE(softf);
 }
 

sys/contrib/ipfilter/netinet/ip_frag.h

@@ -78,6 +78,7 @@ typedef struct ipf_frag_softc_s  {
 	int		ipfr_ttl;
 	int		ipfr_lock;
 	int		ipfr_inited;
+	ipftuneable_t	*ipf_frag_tune;
 	ipfr_t		*ipfr_list;
 	ipfr_t		**ipfr_tail;
 	ipfr_t		*ipfr_natlist;

sys/dev/iicbus/iic.c

@@ -300,9 +300,16 @@ iicrdwr(struct iic_cdevpriv *priv, struct iic_rdwr_data *d, int flags)
 	parent = device_get_parent(iicdev);
 	error = 0;
 
+	if (d->nmsgs > IIC_RDRW_MAX_MSGS)
+		return (EINVAL);
+
 	buf = malloc(sizeof(*d->msgs) * d->nmsgs, M_IIC, M_WAITOK);
 
 	error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs);
+	if (error != 0) {
+		free(buf, M_IIC);
+		return (error);
+	}
 
 	/* Alloc kernel buffers for userland data, copyin write data */
 	usrbufs = malloc(sizeof(void *) * d->nmsgs, M_IIC, M_WAITOK | M_ZERO);
@@ -318,6 +325,8 @@ iicrdwr(struct iic_cdevpriv *priv, struct iic_rdwr_data *d, int flags)
 		m->buf = NULL;
 		if (error != 0)
 			continue;
+
+		/* m->len is uint16_t, so allocation size is capped at 64K. */
 		m->buf = malloc(m->len, M_IIC, M_WAITOK);
 		if (!(m->flags & IIC_M_RD))
 			error = copyin(usrbufs[i], m->buf, m->len);

sys/dev/iicbus/iic.h

@@ -56,6 +56,8 @@ struct iic_rdwr_data {
 	uint32_t nmsgs;
 };
 
+#define IIC_RDRW_MAX_MSGS	42
+
 #define I2CSTART	_IOW('i', 1, struct iiccmd)	/* start condition */
 #define I2CSTOP		_IO('i', 2)			/* stop condition */
 #define I2CRSTCARD	_IOW('i', 3, struct iiccmd)	/* reset the card */