Kristof Provost
f5e0d9fcb4
pf: Fix panic on invalid DIOCRSETTFLAGS ...
If during DIOCRSETTFLAGS pfrio_buffer is NULL copyin() will fault, which we're
not allowed to do with a lock held.
We must count the number of entries in the table and release the lock during
copyin(). Only then can we re-acquire the lock. Note that this is safe, because
pfr_set_tflags() will check if the table and entries exist.
This was discovered by a local syzcaller instance.
MFC after: 1 week
Event: Aberdeen hackathon 2019
2019-04-17 16:42:54 +00:00
2019-04-16 19:46:02 +00:00
2019-04-17 15:27:11 +00:00
2019-03-29 20:21:28 +00:00
2019-01-17 06:35:45 +00:00
2019-04-10 19:49:35 +00:00
2019-04-13 03:32:21 +00:00
2019-04-16 13:26:31 +00:00
2019-04-17 03:29:16 +00:00
2019-04-11 04:24:41 +00:00
2019-03-01 23:30:23 +00:00
2019-02-09 21:08:19 +00:00
2019-04-16 17:12:17 +00:00
2019-04-10 19:18:05 +00:00
2019-04-16 11:37:15 +00:00
2019-04-03 23:57:37 +00:00
2019-04-10 18:15:36 +00:00
2019-04-16 19:46:02 +00:00
2019-04-16 18:47:20 +00:00
2019-02-21 01:30:37 +00:00
2019-04-15 18:40:36 +00:00
2019-03-25 07:48:52 +00:00
2019-04-13 22:00:09 +00:00
2019-04-14 10:18:14 +00:00
2019-03-18 02:40:22 +00:00
2019-03-14 22:30:05 +00:00
2019-04-13 10:47:47 +00:00
2019-04-11 08:00:59 +00:00
2019-04-04 01:02:50 +00:00
2019-04-17 16:42:54 +00:00
2018-12-11 19:32:16 +00:00
2019-01-09 01:11:19 +00:00
2019-02-25 19:14:16 +00:00
2019-04-13 06:30:45 +00:00
2019-04-07 20:12:24 +00:00
2019-04-04 01:23:06 +00:00
2019-04-03 03:57:37 +00:00
2019-04-13 06:30:45 +00:00
2019-04-16 17:12:17 +00:00
2019-02-20 02:14:41 +00:00
2019-02-04 21:28:25 +00:00
2018-12-14 23:53:28 +00:00
2019-04-08 15:20:05 +00:00
2019-04-12 12:46:25 +00:00
2019-04-09 18:07:17 +00:00
2019-01-30 11:34:52 +00:00
f5e0d9fcb4