Vincenzo Maffione 3937299165 netmap: Fix TOCTOU vulnerability in nmreq_copyin ...

The total size of the user-provided nmreq was first computed and then
trusted during the copyin. This might lead to kernel memory corruption
and escape from jails/containers.

Reported by: Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative
Security: CVE-2022-23084
MFC after:	3 days

2022-03-16 06:58:50 +00:00

..

if_ptnet.c

…

if_re_netmap.h

…

if_vtnet_netmap.h

…

netmap_bdg.c

netmap: add a tunable for the maximum number of VALE switches

2022-03-06 17:29:44 +00:00

netmap_bdg.h

…

netmap_freebsd.c

…

netmap_generic.c

…

netmap_kern.h

netmap: add a tunable for the maximum number of VALE switches

2022-03-06 17:29:44 +00:00

netmap_kloop.c

…

netmap_legacy.c

…

netmap_mbq.c

…

netmap_mbq.h

…

netmap_mem2.c

netmap: fix refcount bug in netmap allocator

2022-03-06 16:39:16 +00:00

netmap_mem2.h

…

netmap_monitor.c

…

netmap_null.c

…

netmap_offloadings.c

…

netmap_pipe.c

…

netmap_vale.c

netmap: add a tunable for the maximum number of VALE switches

2022-03-06 17:29:44 +00:00

netmap.c

netmap: Fix TOCTOU vulnerability in nmreq_copyin

2022-03-16 06:58:50 +00:00