Wed Jul 22 14:18:08 2015 UTC ()
Memory leak. Triggerable from an unprivileged user via COMPAT_43.


(maxv)
diff -r1.178 -r1.179 src/sys/kern/uipc_syscalls.c
cvs diff -r1.178 -r1.179 src/sys/kern/uipc_syscalls.c (expand / switch to unified diff)

--- src/sys/kern/uipc_syscalls.c 2015/05/09 15:22:47 1.178
+++ src/sys/kern/uipc_syscalls.c 2015/07/22 14:18:08 1.179
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: uipc_syscalls.c,v 1.178 2015/05/09 15:22:47 rtr Exp $ */ 1/* $NetBSD: uipc_syscalls.c,v 1.179 2015/07/22 14:18:08 maxv Exp $ */
2 2
3/*- 3/*-
4 * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc. 4 * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * This code is derived from software contributed to The NetBSD Foundation 7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Andrew Doran. 8 * by Andrew Doran.
9 * 9 *
10 * Redistribution and use in source and binary forms, with or without 10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions 11 * modification, are permitted provided that the following conditions
12 * are met: 12 * are met:
13 * 1. Redistributions of source code must retain the above copyright 13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer. 14 * notice, this list of conditions and the following disclaimer.
@@ -51,27 +51,27 @@ @@ -51,27 +51,27 @@
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE. 58 * SUCH DAMAGE.
59 * 59 *
60 * @(#)uipc_syscalls.c 8.6 (Berkeley) 2/14/95 60 * @(#)uipc_syscalls.c 8.6 (Berkeley) 2/14/95
61 */ 61 */
62 62
63#include <sys/cdefs.h> 63#include <sys/cdefs.h>
64__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.178 2015/05/09 15:22:47 rtr Exp $"); 64__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.179 2015/07/22 14:18:08 maxv Exp $");
65 65
66#include "opt_pipe.h" 66#include "opt_pipe.h"
67 67
68#include <sys/param.h> 68#include <sys/param.h>
69#include <sys/systm.h> 69#include <sys/systm.h>
70#include <sys/filedesc.h> 70#include <sys/filedesc.h>
71#include <sys/proc.h> 71#include <sys/proc.h>
72#include <sys/file.h> 72#include <sys/file.h>
73#include <sys/buf.h> 73#include <sys/buf.h>
74#define MBUFTYPES 74#define MBUFTYPES
75#include <sys/mbuf.h> 75#include <sys/mbuf.h>
76#include <sys/protosw.h> 76#include <sys/protosw.h>
77#include <sys/socket.h> 77#include <sys/socket.h>
@@ -649,29 +649,36 @@ bad: @@ -649,29 +649,36 @@ bad:
649 m_freem(control); 649 m_freem(control);
650 650
651 return error; 651 return error;
652} 652}
653 653
654int 654int
655do_sys_sendmsg(struct lwp *l, int s, struct msghdr *mp, int flags, 655do_sys_sendmsg(struct lwp *l, int s, struct msghdr *mp, int flags,
656 register_t *retsize) 656 register_t *retsize)
657{ 657{
658 int error; 658 int error;
659 struct socket *so; 659 struct socket *so;
660 file_t *fp; 660 file_t *fp;
661 661
662 if ((error = fd_getsock1(s, &so, &fp)) != 0) 662 if ((error = fd_getsock1(s, &so, &fp)) != 0) {
 663 /* We have to free msg_name and msg_control ourselves */
 664 if (mp->msg_flags & MSG_NAMEMBUF)
 665 m_freem(mp->msg_name);
 666 if (mp->msg_flags & MSG_CONTROLMBUF)
 667 m_freem(mp->msg_control);
663 return error; 668 return error;
 669 }
664 error = do_sys_sendmsg_so(l, s, so, fp, mp, flags, retsize); 670 error = do_sys_sendmsg_so(l, s, so, fp, mp, flags, retsize);
 671 /* msg_name and msg_control freed */
665 fd_putfile(s); 672 fd_putfile(s);
666 return error; 673 return error;
667} 674}
668 675
669int 676int
670sys_recvfrom(struct lwp *l, const struct sys_recvfrom_args *uap, 677sys_recvfrom(struct lwp *l, const struct sys_recvfrom_args *uap,
671 register_t *retval) 678 register_t *retval)
672{ 679{
673 /* { 680 /* {
674 syscallarg(int) s; 681 syscallarg(int) s;
675 syscallarg(void *) buf; 682 syscallarg(void *) buf;
676 syscallarg(size_t) len; 683 syscallarg(size_t) len;
677 syscallarg(int) flags; 684 syscallarg(int) flags;