Author: markj Date: Thu Mar 17 18:49:37 2016 New Revision: 296989 URL: https://svnweb.freebsd.org/changeset/base/296989
Log: 6734 dtrace_canstore_statvar() fails for some valid static variables Reviewed by: Dan McDonald <[email protected]> Approved by: Richard Lowe <[email protected]> Author: Bryan Cantrill <[email protected]> illumos/illumos-gate@d65f2bb4e50559c6c375a2aa9f728cbc34379015 Modified: vendor-sys/illumos/dist/uts/common/dtrace/dtrace.c Changes in other areas also in this revision: Added: vendor/illumos/dist/cmd/dtrace/test/tst/common/scalars/tst.16kglobal.d (contents, props changed) vendor/illumos/dist/cmd/dtrace/test/tst/common/scalars/tst.16klocal.d (contents, props changed) Modified: vendor-sys/illumos/dist/uts/common/dtrace/dtrace.c ============================================================================== --- vendor-sys/illumos/dist/uts/common/dtrace/dtrace.c Thu Mar 17 17:53:38 2016 (r296988) +++ vendor-sys/illumos/dist/uts/common/dtrace/dtrace.c Thu Mar 17 18:49:37 2016 (r296989) @@ -599,8 +599,8 @@ dtrace_canstore_statvar(uint64_t addr, s if (nsvars == 0) return (0); - maxglobalsize = dtrace_statvar_maxsize; - maxlocalsize = (maxglobalsize + sizeof (uint64_t)) * NCPU; + maxglobalsize = dtrace_statvar_maxsize + sizeof (uint64_t); + maxlocalsize = maxglobalsize * NCPU; for (i = 0; i < nsvars; i++) { dtrace_statvar_t *svar = svars[i]; @@ -618,8 +618,8 @@ dtrace_canstore_statvar(uint64_t addr, s * DTrace to escalate an orthogonal kernel heap corruption bug * into the ability to store to arbitrary locations in memory. */ - VERIFY((scope == DIFV_SCOPE_GLOBAL && size < maxglobalsize) || - (scope == DIFV_SCOPE_LOCAL && size < maxlocalsize)); + VERIFY((scope == DIFV_SCOPE_GLOBAL && size <= maxglobalsize) || + (scope == DIFV_SCOPE_LOCAL && size <= maxlocalsize)); if (DTRACE_INRANGE(addr, sz, svar->dtsv_data, svar->dtsv_size)) return (1); _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "[email protected]"
