DF-2299
Missing NULL check on kmalloc return in fwdma_malloc_multiseg
Summary
fwdma_malloc_multiseg calls kmalloc(...M_WAITOK) and immediately dereferences return value (am->ssize=ssize at line 164) without checking for NULL. While DFly slab allocator currently panics rather than returns NULL for M_WAITOK this is latent defect that becomes NULL pointer dereference if allocation flags ever changed to include M_NULLOK or M_NOWAIT. When nseg driven very large by integer overflow (DF-2298) allocation size becomes enormous - slab limit check calls panic() producing DoS. Code contract is wrong.
No comments yet.