more cleanup on close to avoid a use after free
In Linux, some driver specific cleanup is handled with the release
function pointer in struct file_operations.
For amdgpu, this was changed in Linux 6.16 from drm_release() to
amdgpu_drm_release(). Add a file_close function pointer to
struct drm_driver so we can call a function that does the same cleanup.
found by gnezdo@ with KASAN
ok gnezdo@
fix "ifconfig vebX -tagged ifX"
it was wired up in the code to expect an extra argument, which isn't
needed or expected as it is meant to clear all the tags on the
interface.
found by and fix identified by scott colby on bugs@
thanks scott
unlink the transformed temporary file on every commit failure
queue_message_commit() left the .comp/.enc temporary behind on an ENOSPC
rename failure and on the shared err path, so repeatedly triggering
transform or out-of-space failures accumulated orphaned files. unlink
tmppath on all of those paths.
from Andrew Griffiths, ok op@
reject empty or slash-bearing usernames before building the mbox path
mda_mbox_init() builds _PATH_MAILDIR/username and creates and chowns it as
root. the username comes from K_USERINFO table data, which is not checked
for slashes, so a dynamic userbase returning a slashed username could make
root create a path outside the mailbox namespace. in practice, it does not
affect default userbase which goes through getpwnam(), and it requires the
admin to voluntarily create a badly crafted username in the userbase.
from Andrew Griffiths (fixed by me), ok op@
reject CR and LF in argv-derived fields before starting the SMTP dialogue
enqueue interpolates the sender, recipients and DSN options straight into
MAIL FROM / RCPT TO command lines. an embedded CR or LF split the command
boundary and injected additional SMTP commands over the local session, so
refuse any such field up front.
from Andrew Griffiths (fixed by me), ok op@
free the copied envelope on the smarthost lookup failure path
mta_on_smarthost() frees the malloc'd envelope on success, but the
smarthost == NULL branch tempfailed the message and returned without
freeing it, leaking a struct envelope per failed lookup.
from Andrew Griffiths, ok op@
free mda_subaddress in mda_envelope_free()
mda_envelope() duplicates the subaddress with xstrdup() when present but
mda_envelope_free() never released it, leaking one bounded string per
subaddressed local delivery.
from Andrew Griffiths, ok op@
use inflateEnd() to tear down the inflate stream in uncompress_gzip_chunk()
the decompression path sets up the stream with inflateInit2() but the
cleanup block called deflateEnd(), mismatching the zlib inflate/deflate
APIs and leaking the stream state on every gzip queue read.
from Andrew Griffiths, ok op@
stop parsing DNS answers once unpack_rr() reports failure
the MX, MX-preference and spf walkers looped on the attacker-controlled
ancount calling unpack_rr() without checking its return, processing stale
or uninitialized rr contents on malformed or truncated replies. break out
of the loop as soon as unpack_rr() fails.
from Andrew Griffiths, ok op@
sysv: Recheck message queue limit after malloc
que_create() allocates with M_WAIT and may sleep after sys_msgget()
checks num_ques against msgmni. The kernel lock is released while the
thread sleeps, allowing concurrent creators to pass the same check and
exceed the queue limit.
OK: mvs@
sysv: Use zero-based message queue indices
que_ix starts at one, while KERN_SYSVIPC_MSG_INFO allocates msgmni
entries and uses que_ix directly as an array index. The last permitted
queue therefore makes sysctl_sysvmsg() copy one struct msqid_ds past the
allocation, which KASAN detects.
OK: mvs@
IPComp decompression must not overflow mbuf cluster.
Check after decompressing an IPComp packet, that the content fits
into a mbuf cluster. m_copyback() assumes that it can allocate a
single mbuf cluster to enlarge the mbuf chain. That means the
decompressed data must not exceed MAXMCLBYTES. Prevent panic:
m_clget: request for 67948 byte cluster.
reported by Homura Akemi, SecBuddyF, Tencent KeenLab; OK mvs@
IPsec AH must contain replay counter.
Before reading the replay counter from packet header in ah_input(),
make sure that the mbuf is long enough. Prevents panic: m_copydata:
null mbuf.
reported by Homura Akemi, SecBuddyF, Tencent KeenLab; OK mvs@
