summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTheo de Raadt <deraadt@cvs.openbsd.org>2009-06-08 23:18:43 +0000
committerTheo de Raadt <deraadt@cvs.openbsd.org>2009-06-08 23:18:43 +0000
commit531fb9a1b3427d1ce1bd73cb5b95c9cb4038fd30 (patch)
treef5b16c9cf8fa83ea40af28ef75abe7cc9a033d87
parenta4155bc7189ee7e348c6ab2e5e011eb2cb7f430e (diff)
must calculate iovlen or ktrace panics the machine; diff from blambert
and it is pretty critical so commiting it now. Any more fallout from the code 'simplication'?
-rw-r--r--sys/kern/sys_generic.c12
1 files changed, 7 insertions, 5 deletions
diff --git a/sys/kern/sys_generic.c b/sys/kern/sys_generic.c
index 3e885ec53c2..93f1ebed199 100644
--- a/sys/kern/sys_generic.c
+++ b/sys/kern/sys_generic.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sys_generic.c,v 1.65 2009/06/04 00:24:02 blambert Exp $ */
+/* $OpenBSD: sys_generic.c,v 1.66 2009/06/08 23:18:42 deraadt Exp $ */
/* $NetBSD: sys_generic.c,v 1.24 1996/03/29 00:25:32 cgd Exp $ */
/*
@@ -139,13 +139,14 @@ dofilereadv(struct proc *p, int fd, struct file *fp, const struct iovec *iovp,
struct iovec *ktriov = NULL;
#endif
+ /* note: can't use iovlen until iovcnt is validated */
+ iovlen = iovcnt * sizeof(struct iovec);
+
/*
* If the iovec array exists in userspace, it needs to be copied in;
* otherwise, it can be used directly.
*/
if (userspace) {
- /* note: can't use iovlen until iovcnt is validated */
- iovlen = iovcnt * sizeof(struct iovec);
if ((u_int)iovcnt > UIO_SMALLIOV) {
if ((u_int)iovcnt > IOV_MAX) {
error = EINVAL;
@@ -291,13 +292,14 @@ dofilewritev(struct proc *p, int fd, struct file *fp, const struct iovec *iovp,
struct iovec *ktriov = NULL;
#endif
+ /* note: can't use iovlen until iovcnt is validated */
+ iovlen = iovcnt * sizeof(struct iovec);
+
/*
* If the iovec array exists in userspace, it needs to be copied in;
* otherwise, it can be used directly.
*/
if (userspace) {
- /* note: can't use iovlen until iovcnt is validated */
- iovlen = iovcnt * sizeof(struct iovec);
if ((u_int)iovcnt > UIO_SMALLIOV) {
if ((u_int)iovcnt > IOV_MAX) {
error = EINVAL;