Fix the length calculation for the final block of a sendfile(2)
transmission which could be tricked into rounding up to the nearest page size, leaking up to a page of kernel memory. [13:11] In IPv6 and NetATM, stop SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK at the socket layer rather than pass them on to the link layer without validation or credential checks. [SA-13:12] Prevent cross-mount hardlinks between different nullfs mounts of the same underlying filesystem. [SA-13:13] Security: CVE-2013-5666 Security: FreeBSD-SA-13:11.sendfile Security: CVE-2013-5691 Security: FreeBSD-SA-13:12.ifioctl Security: CVE-2013-5710 Security: FreeBSD-SA-13:13.nullfs Approved by: re
This commit is contained in:
parent
9dc29a3cf0
commit
1a05c762b9
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=255442
@ -858,6 +858,15 @@ null_vptocnp(struct vop_vptocnp_args *ap)
|
||||
return (error);
|
||||
}
|
||||
|
||||
static int
|
||||
null_link(struct vop_link_args *ap)
|
||||
{
|
||||
|
||||
if (ap->a_tdvp->v_mount != ap->a_vp->v_mount)
|
||||
return (EXDEV);
|
||||
return (null_bypass((struct vop_generic_args *)ap));
|
||||
}
|
||||
|
||||
/*
|
||||
* Global vfs data structures
|
||||
*/
|
||||
@ -871,6 +880,7 @@ struct vop_vector null_vnodeops = {
|
||||
.vop_getwritemount = null_getwritemount,
|
||||
.vop_inactive = null_inactive,
|
||||
.vop_islocked = vop_stdislocked,
|
||||
.vop_link = null_link,
|
||||
.vop_lock1 = null_lock,
|
||||
.vop_lookup = null_lookup,
|
||||
.vop_open = null_open,
|
||||
|
@ -2221,11 +2221,10 @@ vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio,
|
||||
* or the passed in nbytes.
|
||||
*/
|
||||
pgoff = (vm_offset_t)(off & PAGE_MASK);
|
||||
if (nbytes)
|
||||
rem = (nbytes - fsbytes - loopbytes);
|
||||
else
|
||||
rem = va.va_size -
|
||||
offset - fsbytes - loopbytes;
|
||||
rem = va.va_size - offset;
|
||||
if (nbytes != 0)
|
||||
rem = omin(rem, nbytes);
|
||||
rem -= fsbytes + loopbytes;
|
||||
xfsize = omin(PAGE_SIZE - pgoff, rem);
|
||||
xfsize = omin(space - loopbytes, xfsize);
|
||||
if (xfsize <= 0) {
|
||||
|
18
sys/net/if.c
18
sys/net/if.c
@ -2553,11 +2553,23 @@ ifioctl(struct socket *so, u_long cmd, caddr_t data, struct thread *td)
|
||||
CURVNET_RESTORE();
|
||||
return (EOPNOTSUPP);
|
||||
}
|
||||
|
||||
/*
|
||||
* Pass the request on to the socket control method, and if the
|
||||
* latter returns EOPNOTSUPP, directly to the interface.
|
||||
*
|
||||
* Make an exception for the legacy SIOCSIF* requests. Drivers
|
||||
* trust SIOCSIFADDR et al to come from an already privileged
|
||||
* layer, and do not perform any credentials checks or input
|
||||
* validation.
|
||||
*/
|
||||
#ifndef COMPAT_43
|
||||
error = ((*so->so_proto->pr_usrreqs->pru_control)(so, cmd,
|
||||
data,
|
||||
ifp, td));
|
||||
if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL)
|
||||
if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL &&
|
||||
cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR &&
|
||||
cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK)
|
||||
error = (*ifp->if_ioctl)(ifp, cmd, data);
|
||||
#else
|
||||
{
|
||||
@ -2601,7 +2613,9 @@ ifioctl(struct socket *so, u_long cmd, caddr_t data, struct thread *td)
|
||||
data,
|
||||
ifp, td));
|
||||
if (error == EOPNOTSUPP && ifp != NULL &&
|
||||
ifp->if_ioctl != NULL)
|
||||
ifp->if_ioctl != NULL &&
|
||||
cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR &&
|
||||
cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK)
|
||||
error = (*ifp->if_ioctl)(ifp, cmd, data);
|
||||
switch (ocmd) {
|
||||
|
||||
|
@ -431,6 +431,18 @@ in6_control(struct socket *so, u_long cmd, caddr_t data,
|
||||
case SIOCGIFSTAT_ICMP6:
|
||||
sa6 = &ifr->ifr_addr;
|
||||
break;
|
||||
case SIOCSIFADDR:
|
||||
case SIOCSIFBRDADDR:
|
||||
case SIOCSIFDSTADDR:
|
||||
case SIOCSIFNETMASK:
|
||||
/*
|
||||
* Although we should pass any non-INET6 ioctl requests
|
||||
* down to driver, we filter some legacy INET requests.
|
||||
* Drivers trust SIOCSIFADDR et al to come from an already
|
||||
* privileged layer, and do not perform any credentials
|
||||
* checks or input validation.
|
||||
*/
|
||||
return (EINVAL);
|
||||
default:
|
||||
sa6 = NULL;
|
||||
break;
|
||||
|
@ -339,6 +339,21 @@ natm_usr_control(struct socket *so, u_long cmd, caddr_t arg,
|
||||
npcb = (struct natmpcb *)so->so_pcb;
|
||||
KASSERT(npcb != NULL, ("natm_usr_control: npcb == NULL"));
|
||||
|
||||
switch (cmd) {
|
||||
case SIOCSIFADDR:
|
||||
case SIOCSIFBRDADDR:
|
||||
case SIOCSIFDSTADDR:
|
||||
case SIOCSIFNETMASK:
|
||||
/*
|
||||
* Although we should pass any non-ATM ioctl requests
|
||||
* down to driver, we filter some legacy INET requests.
|
||||
* Drivers trust SIOCSIFADDR et al to come from an already
|
||||
* privileged layer, and do not perform any credentials
|
||||
* checks or input validation.
|
||||
*/
|
||||
return (EINVAL);
|
||||
}
|
||||
|
||||
if (ifp == NULL || ifp->if_ioctl == NULL)
|
||||
return (EOPNOTSUPP);
|
||||
return ((*ifp->if_ioctl)(ifp, cmd, arg));
|
||||
|
Loading…
Reference in New Issue
Block a user