Print this page 
11928 rpcmod's clnt_cots can do zero-length kmem allocations
Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/rpc/clnt_cots.c
          +++ new/usr/src/uts/common/rpc/clnt_cots.c
↓ open down ↓ 14 lines elided ↑ open up ↑ 
  15   15   * If applicable, add the following below this CDDL HEADER, with the
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  
  22   22  /*
  23   23   * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
  24   24   * Copyright (c) 2016 by Delphix. All rights reserved.
       25 + * Copyright 2019 Joyent, Inc.
  25   26   */
  26   27  
  27   28  /*
  28   29   * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  29   30   * Use is subject to license terms.
  30   31   */
  31   32  
  32   33  /*
  33   34   * Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T
  34   35   *              All Rights Reserved
↓ open down ↓ 1894 lines elided ↑ open up ↑ 
1929 1930                  if (i == clnt_max_conns) {
1930 1931                          /*
1931 1932                           * Copy into the handle the source address of
1932 1933                           * the connection, which we will use in case of
1933 1934                           * a later retry.
1934 1935                           */
1935 1936                          if (srcaddr->len != lru_entry->x_src.len) {
1936 1937                                  if (srcaddr->len > 0)
1937 1938                                          kmem_free(srcaddr->buf,
1938 1939                                              srcaddr->maxlen);
1939      -                                srcaddr->buf = kmem_zalloc(
     1940 +                                ASSERT(lru_entry->x_src.len != 0);
     1941 +                                srcaddr->buf = kmem_alloc(
1940 1942                                      lru_entry->x_src.len, KM_SLEEP);
1941 1943                                  srcaddr->maxlen = srcaddr->len =
1942 1944                                      lru_entry->x_src.len;
1943 1945                          }
1944 1946                          bcopy(lru_entry->x_src.buf, srcaddr->buf, srcaddr->len);
1945 1947                          RPCLOG(2, "connmgr_get: call going out on %p\n",
1946 1948                              (void *)lru_entry);
1947 1949                          lru_entry->x_time = ddi_get_lbolt();
1948 1950                          CONN_HOLD(lru_entry);
1949 1951
↓ open down ↓ 134 lines elided ↑ open up ↑ 
2084 2086                   * rebind and reconnect and not hang the client machine.
2085 2087                   */
2086 2088                  RPCLOG0(8, "connmgr_get: no entry in list for retry\n");
2087 2089          }
2088 2090          /*
2089 2091           * Set up a transport entry in the connection manager's list.
2090 2092           */
2091 2093          cm_entry = (struct cm_xprt *)
2092 2094              kmem_zalloc(sizeof (struct cm_xprt), KM_SLEEP);
2093 2095  
2094      -        cm_entry->x_server.buf = kmem_zalloc(destaddr->len, KM_SLEEP);
     2096 +        cm_entry->x_server.buf = kmem_alloc(destaddr->len, KM_SLEEP);
2095 2097          bcopy(destaddr->buf, cm_entry->x_server.buf, destaddr->len);
2096 2098          cm_entry->x_server.len = cm_entry->x_server.maxlen = destaddr->len;
2097 2099  
2098 2100          cm_entry->x_state_flags = X_THREAD;
2099 2101          cm_entry->x_ref = 1;
2100 2102          cm_entry->x_family = addrfmly;
2101 2103          cm_entry->x_rdev = device;
2102 2104          cm_entry->x_zoneid = zoneid;
2103 2105          mutex_init(&cm_entry->x_lock, NULL, MUTEX_DEFAULT, NULL);
2104 2106          cv_init(&cm_entry->x_cv, NULL, CV_DEFAULT, NULL);
↓ open down ↓ 144 lines elided ↑ open up ↑ 
2249 2251                  *rpcerr = call.call_err;
2250 2252                  cv_destroy(&call.call_cv);
2251 2253  
2252 2254          }
2253 2255  
2254 2256          mutex_enter(&connmgr_lock);
2255 2257  
2256 2258          /*
2257 2259           * Set up a transport entry in the connection manager's list.
2258 2260           */
2259      -        cm_entry->x_src.buf = kmem_zalloc(srcaddr->len, KM_SLEEP);
2260      -        bcopy(srcaddr->buf, cm_entry->x_src.buf, srcaddr->len);
2261      -        cm_entry->x_src.len = cm_entry->x_src.maxlen = srcaddr->len;
     2261 +        if (srcaddr->len > 0) {
     2262 +                cm_entry->x_src.buf = kmem_alloc(srcaddr->len, KM_SLEEP);
     2263 +                bcopy(srcaddr->buf, cm_entry->x_src.buf, srcaddr->len);
     2264 +                cm_entry->x_src.len = cm_entry->x_src.maxlen = srcaddr->len;
     2265 +        } /* Else kmem_zalloc() of cm_entry already sets its x_src to NULL. */
2262 2266  
2263 2267          cm_entry->x_tiptr = tiptr;
2264 2268          cm_entry->x_time = ddi_get_lbolt();
2265 2269  
2266 2270          if (tiptr->tp_info.servtype == T_COTS_ORD)
2267 2271                  cm_entry->x_ordrel = TRUE;
2268 2272          else
2269 2273                  cm_entry->x_ordrel = FALSE;
2270 2274  
2271 2275          cm_entry->x_tidu_size = tidu_size;
↓ open down ↓ 161 lines elided ↑ open up ↑ 
2433 2437          if (srcaddr != NULL) {
2434 2438                  /*
2435 2439                   * Copy into the handle the
2436 2440                   * source address of the
2437 2441                   * connection, which we will use
2438 2442                   * in case of a later retry.
2439 2443                   */
2440 2444                  if (srcaddr->len != cm_entry->x_src.len) {
2441 2445                          if (srcaddr->maxlen > 0)
2442 2446                                  kmem_free(srcaddr->buf, srcaddr->maxlen);
2443      -                        srcaddr->buf = kmem_zalloc(cm_entry->x_src.len,
     2447 +                        ASSERT(cm_entry->x_src.len != 0);
     2448 +                        srcaddr->buf = kmem_alloc(cm_entry->x_src.len,
2444 2449                              KM_SLEEP);
2445      -                        srcaddr->maxlen = srcaddr->len =
2446      -                            cm_entry->x_src.len;
     2450 +                        srcaddr->maxlen = srcaddr->len = cm_entry->x_src.len;
2447 2451                  }
2448 2452                  bcopy(cm_entry->x_src.buf, srcaddr->buf, srcaddr->len);
2449 2453          }
2450 2454          cm_entry->x_time = ddi_get_lbolt();
2451 2455          mutex_exit(&connmgr_lock);
2452 2456          return (cm_entry);
2453 2457  }
2454 2458  
2455 2459  /*
2456 2460   * If we need to send a T_DISCON_REQ, send one.
↓ open down ↓ 167 lines elided ↑ open up ↑ 
2624 2628  /*
2625 2629   * Given an open stream, connect to the remote.  Returns true if connected,
2626 2630   * false otherwise.
2627 2631   */
2628 2632  static bool_t
2629 2633  connmgr_connect(
2630 2634          struct cm_xprt          *cm_entry,
2631 2635          queue_t                 *wq,
2632 2636          struct netbuf           *addr,
2633 2637          int                     addrfmly,
2634      -        calllist_t              *e,
2635      -        int                     *tidu_ptr,
2636      -        bool_t                  reconnect,
2637      -        const struct timeval    *waitp,
2638      -        bool_t                  nosignal,
     2638 +        calllist_t              *e,
     2639 +        int                     *tidu_ptr,
     2640 +        bool_t                  reconnect,
     2641 +        const struct timeval    *waitp,
     2642 +        bool_t                  nosignal,
2639 2643          cred_t                  *cr)
2640 2644  {
2641 2645          mblk_t *mp;
2642 2646          struct T_conn_req *tcr;
2643 2647          struct T_info_ack *tinfo;
2644 2648          int interrupted, error;
2645 2649          int tidu_size, kstat_instance;
2646 2650  
2647 2651          /* if it's a reconnect, flush any lingering data messages */
2648 2652          if (reconnect)
↓ open down ↓ 1112 lines elided ↑ open up ↑ 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX