`sysctl -a` would simply crash on CHERI allowing a developer to catch this without KASAN being involved.
Another problem is writing good automated tests is hard and often skipped. Lots of software engineering teams talk about the wonders of automated tests. Unfortunately, many automated tests are not very good and either do not ensure the major functionality works or just do not test some of the code. There are also limits to how much time a software engineer has to test. No one can test everything.
Basically, I am not surprised developers make mistakes and I am not surprised the tests either did not catch this mistake or even did not exist. Software is very hard and software engineers are far from perfect.
Correct me if I'm wrong but you get 2 bytes of kernel data (potentially blank padding) and the same two bytes each time?
- int new_value = *(int *)oidp->oid_arg1;
+ int new_value = *(uint16_t *)oidp->oid_arg1;
Ahh, because `new_value` is being given to `sysctl_handle_int(..., &new_value, ...);` which of course expects an `int`. So then it begs the question: if the value is really a `uint16_t`, then why is it being handled through a plain `int`? It smells like there could easily be tons of other memory-safety and/or type confusion problems endemic to the sysctl API.
I don't think it begs the question, but it does raise one!
The phrase can be confusing because of its overloaded definitions, so it's best to avoid it. But if you understood what someone meant when they used it, then... you understood it's meaning.
Remember to treat the study of language descriptively rather than prescriptively!
https://chatgpt.com/share/6793a2d1-5f84-8006-8e78-16be4d4908...