Date: Sat, 14 Mar 2015 17:52:12 -0400 From: John Baldwin <jhb@freebsd.org> To: Ian Lepore <ian@freebsd.org> Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org Subject: Re: svn commit: r279997 - head/sys/netinet Message-ID: <12123739.Rz3jP8R4fM@ralph.baldwin.cx> In-Reply-To: <201503141811.t2EIBPeE006504@svn.freebsd.org> References: <201503141811.t2EIBPeE006504@svn.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Saturday, March 14, 2015 06:11:25 PM Ian Lepore wrote: > Author: ian > Date: Sat Mar 14 18:11:24 2015 > New Revision: 279997 > URL: https://svnweb.freebsd.org/changeset/base/279997 > > Log: > Use sbuf_new_for_sysctl() instead of plain sbuf_new() to ensure sysctl > string returned to userland is nulterminated. > > PR: 195668 This is not safe. sbuf_printf() is invoked with a lock held, so it isn't safe for the sbuf code to do a drain here. With sbuf_new_for_sysctl(), any call to an sbuf routine is a potential page fault, so the handler must either use sysctl_wire_old_buffer(), or the contents need to be output in one go. For this case I would prefer to use sbuf_len(sb) + 1 (or add INCLUDENUL to the args when creating it) and leave the sole SYSCTL_OUT() at the end. You will want to check the one or two other places you converted for this same issue as well. -- John Baldwin
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?12123739.Rz3jP8R4fM>