Provide out-of-band information about firmware events to bwfm_rx().
This allows the driver to ignore firmware events which did not actually
arrive on a firmware event Rx ring. An exception are USB devices which
seem to only offer a single Rx pipe across which data frames and firmware
events are multiplexed.
Previously, firmware events were detected purely based on attributes of
the ethernet header in a received frame, which could potentially be a
crafted header in frames received on the air, injecting firmware events
into the driver from the outside.
I am unsure if such injection can happen on real hardware. It will depend
on the firmware being careful enough about filtering out event frames it
did not generate itself. The corresponding report by Acts1631 was triggering
the problem by calling bwfm_rx() manually with crafted ethernet packets.
But this is worth hardening nonetheless, and the Linux brcmfmac driver
has a similar check in place.
Tested by martijn@ on PCI in hostap mode and by myself on USB on client mode.
do not blindly trust bss->length in bwfm scan results; pointed out by Acts1631
A proposed diff to fix the issue was provided by Acts1631, but I wrote my own.
ocsp: validate URI characters in OCSP
In OCSP_sendreq_new() and OCSP_parse_url() reject URIs containing control
characters. Since these APIs are typically used to create a POST request
to an untrusted cert's Authority Information Access accessLocation URI,
lack of sanitization meant that there is a path for header injection via
CRLF and similar tricks.
Reported by Aziz ELBELAYCHY (also for ocspcheck.c r1.40)
ok beck kenjiro
Wait up to 1 second for lite software reset to complete instead of 5 ms,
matching the Linux lan78xx driver. This fixes "timeout on lite software reset"
on a LAN7800.
ok kettenis@
Fix a kernel stack overflow in mue_init_ltm().
idx[] was uint8_t[6] but the LTM table read into it is 24 bytes.
Also handle mue_read_eeprom() errors like Linux does and byte swap
the values with letoh32().
Reported by Acts1631
ok kettenis@
ocspcheck: check all OCSP AIA URLs for invalid characters
Check every OCSP AIA URL in the certificate, rather than only the
first. The first URL remains the one used for the request.
pointed out by tb@
ok tb@ beck@
ocspcheck: reject control characters in OCSP URL
Reject OCSP URL containing non-ASCII or control characters before
using their path in an HTTP request. This prevents HTTP request
injection via a certificate's AIA URI.
ok tb@ beck@
sys/video: fix video buffer handling and mmap lifetime
Check dequeue errors and allocation bounds, correct the mmap buffer base,
and revoke user mappings before freeing capture buffers.
Based on diffs from Acts1631, thanks!
OK: mglocker@
Back out the last video(4) vulnerability fix, which changed the
kern.video.record behavior. We found a solution in the meantime to
fix the vulnerability without changing the previous kern.video.record
behavior (blanking), which will be committed next.
ok deraadt@, kirill@
sys/video: fix video buffer handling and mmap lifetime
Check dequeue errors and allocation bounds, correct the mmap buffer base,
and revoke user mappings before freeing capture buffers.
Based on diffs from Acts1631, thanks!
from kirill@; OK mglocker@
this is errata/8.0/004_video.patch.sig
sys/video: fix video buffer handling and mmap lifetime
Check dequeue errors and allocation bounds, correct the mmap buffer base,
and revoke user mappings before freeing capture buffers.
Based on diffs from Acts1631, thanks!
from kirill@; OK mglocker@
this is errata/7.9/039_video.patch.sig
sys/video: fix video buffer handling and mmap lifetime
Check dequeue errors and allocation bounds, correct the mmap buffer base,
and revoke user mappings before freeing capture buffers.
Based on diffs from Acts1631, thanks!
from kirill@; OK mglocker@
this is errata/7.8/075_video.patch.sig
Implement draft-herdes-idr-otc-rs-verification-01
For route-server clients OTC handling should be performed like for the
peer-to-peer role. This is because the route-server itself should tag
all routes with its own AS in the OTC attribute. So if the OTC attribute
is set but not equal to the RS AS then this is a leak.
OK tb@ job@
