kernel -- Prevent POSIX MQ from overflowing malloc zones.

diff --git a/sys/kern/sys_mqueue.c b/sys/kern/sys_mqueue.c
index 09686ba..aa8ce99 100644 (file)
--- a/sys/kern/sys_mqueue.c
+++ b/sys/kern/sys_mqueue.c
@@ -471,7 +471,9 @@ sys_mq_open(struct mq_open_args *uap)
        }
 
        /* Get the name from the user-space */
-       name = kmalloc(MQ_NAMELEN, M_MQBUF, M_WAITOK | M_ZERO);
+       name = kmalloc(MQ_NAMELEN, M_MQBUF, M_WAITOK | M_ZERO | M_NULLOK);
+       if (name == NULL)
+               return (ENOMEM);
        error = copyinstr(SCARG(uap, name), name, MQ_NAMELEN - 1, NULL);
        if (error) {
                kfree(name, M_MQBUF);
@@ -521,7 +523,12 @@ sys_mq_open(struct mq_open_args *uap)
                 * Allocate new mqueue, initialize data structures,
                 * copy the name, attributes and set the flag.
                 */
-               mq_new = kmalloc(sizeof(struct mqueue), M_MQBUF, M_WAITOK | M_ZERO);
+               mq_new = kmalloc(sizeof(struct mqueue), M_MQBUF, 
+                                       M_WAITOK | M_ZERO | M_NULLOK);
+               if (mq_new == NULL) {
+                       kfree(name, M_MQBUF);
+                       return (ENOMEM);
+               }
 
                lockinit(&mq_new->mq_mtx, "mq_new->mq_mtx", 0, LK_CANRECURSE);
                for (i = 0; i < (MQ_PQSIZE + 1); i++) {
@@ -831,10 +838,13 @@ mq_send1(struct lwp *l, mqd_t mqdes, const char *msg_ptr, size_t msg_len,
                return EMSGSIZE;
 
        if (size > MQ_DEF_MSGSIZE) {
-               msg = kmalloc(size, M_MQBUF, M_WAITOK);
+               msg = kmalloc(size, M_MQBUF, M_WAITOK | M_NULLOK);
        } else {
-               msg = objcache_get(mqmsg_cache, M_WAITOK);
+               msg = objcache_get(mqmsg_cache, M_WAITOK | M_NULLOK);
        }
+       if (msg == NULL)
+               return (ENOMEM);
+
 
        /* Get the data from user-space */
        error = copyin(msg_ptr, msg->msg_ptr, msg_len);
@@ -1114,7 +1124,9 @@ sys_mq_unlink(struct mq_unlink_args *uap)
        int error, refcnt = 0;
 
        /* Get the name from the user-space */
-       name = kmalloc(MQ_NAMELEN, M_MQBUF, M_WAITOK | M_ZERO);
+       name = kmalloc(MQ_NAMELEN, M_MQBUF, M_WAITOK | M_ZERO | M_NULLOK);
+       if (name == NULL)
+               return (ENOMEM);
        error = copyinstr(SCARG(uap, name), name, MQ_NAMELEN - 1, NULL);
        if (error) {
                kfree(name, M_MQBUF);