Skip to content

Commit

Permalink
MFC r209624
Browse files Browse the repository at this point in the history
 * Do not dereference a NULL pointer when calling an SCTP send syscall
   not providing a destination address and using ktrace.
 * Do not copy out kernel memory when providing sinfo for sctp_recvmsg().
 Both bugs where reported by Valentin Nechayev.
 The first bug results in a kernel panic.
Approved by: re@
  • Loading branch information
tuexen committed Jul 5, 2010
1 parent 568d5ef commit 77a57e1
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions sys/kern/uipc_syscalls.c
Expand Up @@ -2413,7 +2413,7 @@ sctp_generic_sendmsg (td, uap)
if (error)
goto sctp_bad;
#ifdef KTRACE
if (KTRPOINT(td, KTR_STRUCT))
if (to && (KTRPOINT(td, KTR_STRUCT)))
ktrsockaddr(to);
#endif

Expand Down Expand Up @@ -2527,7 +2527,7 @@ sctp_generic_sendmsg_iov(td, uap)
if (error)
goto sctp_bad1;
#ifdef KTRACE
if (KTRPOINT(td, KTR_STRUCT))
if (to && (KTRPOINT(td, KTR_STRUCT)))
ktrsockaddr(to);
#endif

Expand Down Expand Up @@ -2681,6 +2681,7 @@ sctp_generic_recvmsg(td, uap)
if (KTRPOINT(td, KTR_GENIO))
ktruio = cloneuio(&auio);
#endif /* KTRACE */
memset(&sinfo, 0, sizeof(struct sctp_sndrcvinfo));
CURVNET_SET(so->so_vnet);
error = sctp_sorecvmsg(so, &auio, (struct mbuf **)NULL,
fromsa, fromlen, &msg_flags,
Expand Down

0 comments on commit 77a57e1

Please sign in to comment.