Date: Wed, 12 Aug 2009 20:30:27 +0000 (UTC) From: Rick Macklem <rmacklem@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-other@freebsd.org Subject: svn commit: r196153 - in stable/8/sys: . amd64/include/xen cddl/contrib/opensolaris contrib/dev/acpica contrib/pf dev/ata dev/cxgb dev/sound/usb dev/usb dev/usb/controller dev/usb/input dev/usb/mis... Message-ID: <200908122030.n7CKUR1o075657@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rmacklem Date: Wed Aug 12 20:30:27 2009 New Revision: 196153 URL: http://svn.freebsd.org/changeset/base/196153 Log: MFC r196149: Add a check for a NULL mbuf ptr at the beginning of xdrmbuf_inline() so that it returns failure instead of crashing when "m->m_len" is executed and m == NULL. The mbuf ptr can be NULL when a call to xdrmbuf_getbytes() gets the bytes it needs, but they are at the end of a short RPC reply. When this happens, xdrmbuf_getbytes() returns success, but advances the mbuf ptr (xdrs->x_private) to m_next, which is NULL. If this is followed by a call to xdrmbuf_getlong(), it calls xdrmbuf_inline(), which would cause a crash by accessing "m->m_len". Approved by: re (rwatson), kib (mentor) Modified: stable/8/sys/ (props changed) stable/8/sys/amd64/include/xen/ (props changed) stable/8/sys/cddl/contrib/opensolaris/ (props changed) stable/8/sys/contrib/dev/acpica/ (props changed) stable/8/sys/contrib/pf/ (props changed) stable/8/sys/dev/ata/ (props changed) stable/8/sys/dev/ata/ata-usb.c (props changed) stable/8/sys/dev/cxgb/ (props changed) stable/8/sys/dev/sound/usb/uaudio.c (props changed) stable/8/sys/dev/sound/usb/uaudio.h (props changed) stable/8/sys/dev/sound/usb/uaudio_pcm.c (props changed) stable/8/sys/dev/sound/usb/uaudioreg.h (props changed) stable/8/sys/dev/usb/controller/at91dci.c (props changed) stable/8/sys/dev/usb/controller/at91dci.h (props changed) stable/8/sys/dev/usb/controller/at91dci_atmelarm.c (props changed) stable/8/sys/dev/usb/controller/atmegadci.c (props changed) stable/8/sys/dev/usb/controller/atmegadci.h (props changed) stable/8/sys/dev/usb/controller/atmegadci_atmelarm.c (props changed) stable/8/sys/dev/usb/controller/ehci.c (props changed) stable/8/sys/dev/usb/controller/ehci.h (props changed) stable/8/sys/dev/usb/controller/ehci_ixp4xx.c (props changed) stable/8/sys/dev/usb/controller/ehci_mbus.c (props changed) stable/8/sys/dev/usb/controller/ehci_pci.c (props changed) stable/8/sys/dev/usb/controller/musb_otg.c (props changed) stable/8/sys/dev/usb/controller/musb_otg.h (props changed) stable/8/sys/dev/usb/controller/musb_otg_atmelarm.c (props changed) stable/8/sys/dev/usb/controller/ohci.c (props changed) stable/8/sys/dev/usb/controller/ohci.h (props changed) stable/8/sys/dev/usb/controller/ohci_atmelarm.c (props changed) stable/8/sys/dev/usb/controller/ohci_pci.c (props changed) stable/8/sys/dev/usb/controller/uhci.c (props changed) stable/8/sys/dev/usb/controller/uhci.h (props changed) stable/8/sys/dev/usb/controller/uhci_pci.c (props changed) stable/8/sys/dev/usb/controller/usb_controller.c (props changed) stable/8/sys/dev/usb/controller/uss820dci.c (props changed) stable/8/sys/dev/usb/controller/uss820dci.h (props changed) stable/8/sys/dev/usb/controller/uss820dci_atmelarm.c (props changed) stable/8/sys/dev/usb/input/uhid.c (props changed) stable/8/sys/dev/usb/input/ukbd.c (props changed) stable/8/sys/dev/usb/input/ums.c (props changed) stable/8/sys/dev/usb/input/usb_rdesc.h (props changed) stable/8/sys/dev/usb/misc/udbp.c (props changed) stable/8/sys/dev/usb/misc/udbp.h (props changed) stable/8/sys/dev/usb/misc/ufm.c (props changed) stable/8/sys/dev/usb/net/if_aue.c (props changed) stable/8/sys/dev/usb/net/if_auereg.h (props changed) stable/8/sys/dev/usb/net/if_axe.c (props changed) stable/8/sys/dev/usb/net/if_axereg.h (props changed) stable/8/sys/dev/usb/net/if_cdce.c (props changed) stable/8/sys/dev/usb/net/if_cdcereg.h (props changed) stable/8/sys/dev/usb/net/if_cue.c (props changed) stable/8/sys/dev/usb/net/if_cuereg.h (props changed) stable/8/sys/dev/usb/net/if_kue.c (props changed) stable/8/sys/dev/usb/net/if_kuefw.h (props changed) stable/8/sys/dev/usb/net/if_kuereg.h (props changed) stable/8/sys/dev/usb/net/if_rue.c (props changed) stable/8/sys/dev/usb/net/if_ruereg.h (props changed) stable/8/sys/dev/usb/net/if_udav.c (props changed) stable/8/sys/dev/usb/net/if_udavreg.h (props changed) stable/8/sys/dev/usb/net/usb_ethernet.c (props changed) stable/8/sys/dev/usb/net/usb_ethernet.h (props changed) stable/8/sys/dev/usb/quirk/usb_quirk.c (props changed) stable/8/sys/dev/usb/quirk/usb_quirk.h (props changed) stable/8/sys/dev/usb/serial/u3g.c (props changed) stable/8/sys/dev/usb/serial/uark.c (props changed) stable/8/sys/dev/usb/serial/ubsa.c (props changed) stable/8/sys/dev/usb/serial/ubser.c (props changed) stable/8/sys/dev/usb/serial/uchcom.c (props changed) stable/8/sys/dev/usb/serial/ucycom.c (props changed) stable/8/sys/dev/usb/serial/ufoma.c (props changed) stable/8/sys/dev/usb/serial/uftdi.c (props changed) stable/8/sys/dev/usb/serial/uftdi_reg.h (props changed) stable/8/sys/dev/usb/serial/ugensa.c (props changed) stable/8/sys/dev/usb/serial/uipaq.c (props changed) stable/8/sys/dev/usb/serial/ulpt.c (props changed) stable/8/sys/dev/usb/serial/umct.c (props changed) stable/8/sys/dev/usb/serial/umodem.c (props changed) stable/8/sys/dev/usb/serial/umoscom.c (props changed) stable/8/sys/dev/usb/serial/uplcom.c (props changed) stable/8/sys/dev/usb/serial/usb_serial.c (props changed) stable/8/sys/dev/usb/serial/usb_serial.h (props changed) stable/8/sys/dev/usb/serial/uslcom.c (props changed) stable/8/sys/dev/usb/serial/uvisor.c (props changed) stable/8/sys/dev/usb/serial/uvscom.c (props changed) stable/8/sys/dev/usb/storage/rio500_usb.h (props changed) stable/8/sys/dev/usb/storage/umass.c (props changed) stable/8/sys/dev/usb/storage/urio.c (props changed) stable/8/sys/dev/usb/storage/ustorage_fs.c (props changed) stable/8/sys/dev/usb/template/usb_template.c (props changed) stable/8/sys/dev/usb/template/usb_template.h (props changed) stable/8/sys/dev/usb/template/usb_template_cdce.c (props changed) stable/8/sys/dev/usb/template/usb_template_msc.c (props changed) stable/8/sys/dev/usb/template/usb_template_mtp.c (props changed) stable/8/sys/dev/usb/ufm_ioctl.h (props changed) stable/8/sys/dev/usb/usb.h (props changed) stable/8/sys/dev/usb/usb_bus.h (props changed) stable/8/sys/dev/usb/usb_busdma.c (props changed) stable/8/sys/dev/usb/usb_busdma.h (props changed) stable/8/sys/dev/usb/usb_cdc.h (props changed) stable/8/sys/dev/usb/usb_compat_linux.c (props changed) stable/8/sys/dev/usb/usb_compat_linux.h (props changed) stable/8/sys/dev/usb/usb_controller.h (props changed) stable/8/sys/dev/usb/usb_core.c (props changed) stable/8/sys/dev/usb/usb_core.h (props changed) stable/8/sys/dev/usb/usb_debug.c (props changed) stable/8/sys/dev/usb/usb_debug.h (props changed) stable/8/sys/dev/usb/usb_dev.c (props changed) stable/8/sys/dev/usb/usb_dev.h (props changed) stable/8/sys/dev/usb/usb_device.c (props changed) stable/8/sys/dev/usb/usb_device.h (props changed) stable/8/sys/dev/usb/usb_dynamic.c (props changed) stable/8/sys/dev/usb/usb_dynamic.h (props changed) stable/8/sys/dev/usb/usb_endian.h (props changed) stable/8/sys/dev/usb/usb_error.c (props changed) stable/8/sys/dev/usb/usb_generic.c (props changed) stable/8/sys/dev/usb/usb_generic.h (props changed) stable/8/sys/dev/usb/usb_handle_request.c (props changed) stable/8/sys/dev/usb/usb_hid.c (props changed) stable/8/sys/dev/usb/usb_hub.c (props changed) stable/8/sys/dev/usb/usb_hub.h (props changed) stable/8/sys/dev/usb/usb_if.m (props changed) stable/8/sys/dev/usb/usb_ioctl.h (props changed) stable/8/sys/dev/usb/usb_lookup.c (props changed) stable/8/sys/dev/usb/usb_mbuf.c (props changed) stable/8/sys/dev/usb/usb_mbuf.h (props changed) stable/8/sys/dev/usb/usb_msctest.c (props changed) stable/8/sys/dev/usb/usb_msctest.h (props changed) stable/8/sys/dev/usb/usb_parse.c (props changed) stable/8/sys/dev/usb/usb_pci.h (props changed) stable/8/sys/dev/usb/usb_process.c (props changed) stable/8/sys/dev/usb/usb_process.h (props changed) stable/8/sys/dev/usb/usb_request.c (props changed) stable/8/sys/dev/usb/usb_request.h (props changed) stable/8/sys/dev/usb/usb_transfer.c (props changed) stable/8/sys/dev/usb/usb_transfer.h (props changed) stable/8/sys/dev/usb/usb_util.c (props changed) stable/8/sys/dev/usb/usb_util.h (props changed) stable/8/sys/dev/usb/usbdevs (props changed) stable/8/sys/dev/usb/usbhid.h (props changed) stable/8/sys/dev/usb/wlan/if_rum.c (props changed) stable/8/sys/dev/usb/wlan/if_rumfw.h (props changed) stable/8/sys/dev/usb/wlan/if_rumreg.h (props changed) stable/8/sys/dev/usb/wlan/if_rumvar.h (props changed) stable/8/sys/dev/usb/wlan/if_ural.c (props changed) stable/8/sys/dev/usb/wlan/if_uralreg.h (props changed) stable/8/sys/dev/usb/wlan/if_uralvar.h (props changed) stable/8/sys/dev/usb/wlan/if_zyd.c (props changed) stable/8/sys/dev/usb/wlan/if_zydfw.h (props changed) stable/8/sys/dev/usb/wlan/if_zydreg.h (props changed) stable/8/sys/dev/xen/netfront/ (props changed) stable/8/sys/dev/xen/xenpci/ (props changed) stable/8/sys/modules/dtrace/dtnfsclient/ (props changed) stable/8/sys/modules/ip6_mroute_mod/ (props changed) stable/8/sys/modules/ipmi/ipmi_linux/ (props changed) stable/8/sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c (props changed) stable/8/sys/netgraph/bluetooth/drivers/ubt/ng_ubt_var.h (props changed) stable/8/sys/netgraph/bluetooth/drivers/ubtbcmfw/ubtbcmfw.c (props changed) stable/8/sys/netinet/ipfw/ip_dummynet.c (props changed) stable/8/sys/netinet/ipfw/ip_fw2.c (props changed) stable/8/sys/netinet/ipfw/ip_fw_nat.c (props changed) stable/8/sys/netinet/ipfw/ip_fw_pfil.c (props changed) stable/8/sys/netipx/spx_reass.c (props changed) stable/8/sys/xdr/xdr_mbuf.c stable/8/sys/xen/evtchn.h (props changed) stable/8/sys/xen/hypervisor.h (props changed) stable/8/sys/xen/xen_intr.h (props changed) Modified: stable/8/sys/xdr/xdr_mbuf.c ============================================================================== --- stable/8/sys/xdr/xdr_mbuf.c Wed Aug 12 19:15:26 2009 (r196152) +++ stable/8/sys/xdr/xdr_mbuf.c Wed Aug 12 20:30:27 2009 (r196153) @@ -282,6 +282,8 @@ xdrmbuf_inline(XDR *xdrs, u_int len) size_t available; char *p; + if (!m) + return (0); if (xdrs->x_op == XDR_ENCODE) { available = M_TRAILINGSPACE(m) + (m->m_len - xdrs->x_handy); } else {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200908122030.n7CKUR1o075657>