Re: Fwd: Any user can panic OpenBSD machine

[dag-erli () IFI UIO NO (Dag-Erling Coidan Smørgrav)]

"Todd C. Miller" <Todd.Miller () COURTESAN COM> writes:
> In message <v6pver2kl7.fsf () kechara lh vix com>
>         so spake Michael Graff (explorer):
> > I tested a NetBSD/i386-1.3.2 machine just now, which also returned
> > EINVAL.
> That's not correct behavior either.  iov_len is unsigned so making it
> -1 (which is the unsigned value 4294967295) should not be an error.

Not at all:

/sys/kern/sys_generic.c:
                if (uap->iovcnt > UIO_MAXIOV)
                        return (EINVAL);

/sys/sys/uio.h:
#define UIO_MAXIOV      1024            /* max 1K of iov's */

-1 is rejected with EINVAL because 4294967295 > 1024.

BTW, FreeBSD is immune, too. As a matter of fact, the original BSD
version (SCCS ID "@(#)sys_generic.c 8.5 (Berkeley) 1/21/94") has the
check, so the OpenBSD folks must have f*d it up somewhere along the
way.

DES (aka des () freebsd org)
--
Dag-Erling Smørgrav - dag-erli () ifi uio no