Avoid sleeping while recording SEM_UNDO information
sys_semop(), by way of semundo_adjust() and semu_alloc(), could sleep in
pool_get(PR_WAITOK) after it had already applied the semaphore operations.
Another process can remove the set with IPC_RMID while we sleep; we then write
sempid and sem_otime through the freed semid_ds_kern and sem_base, and record
an undo entry for a set semundo_clear() has already swept, which panics
semexit() when the process exits.
This was introduced as a fallback in rev 1.14, after moving the
structures from a static array to a pool made the allocation able to
fail at all. semop(2) documents ENOSPC, so drop the fallback with the
extra complexity to work around the sleep.
semundo_adjust() must then stop freeing an emptied structure in the middle of
an operation: sys_semop()'s rollback can need it again, and re-creating it
there is allowed to fail, which is a panic. Keep it until done2. That also
takes a second sleeping pool_put() out of the done: region.
[8 lines not shown]
Avoid sleeping while recording SEM_UNDO information
sys_semop(), by way of semundo_adjust() and semu_alloc(), could sleep in
pool_get(PR_WAITOK) after it had already applied the semaphore operations.
Another process can remove the set with IPC_RMID while we sleep; we then write
sempid and sem_otime through the freed semid_ds_kern and sem_base, and record
an undo entry for a set semundo_clear() has already swept, which panics
semexit() when the process exits.
This was introduced as a fallback in rev 1.14, after moving the
structures from a static array to a pool made the allocation able to
fail at all. semop(2) documents ENOSPC, so drop the fallback with the
extra complexity to work around the sleep.
semundo_adjust() must then stop freeing an emptied structure in the middle of
an operation: sys_semop()'s rollback can need it again, and re-creating it
there is allowed to fail, which is a panic. Keep it until done2. That also
takes a second sleeping pool_put() out of the done: region.
[8 lines not shown]
In wg_bind() close IPv4 socket while failed to bind IPv6 socket with
automatic port selection.
from mvs@; From Acts1631.
this is errata/7.9/028_wgbind.patch.sig
In wg_bind() close IPv4 socket while failed to bind IPv6 socket with
automatic port selection.
from mvs@; From Acts1631.
this is errata/7.8/064_wgbind.patch.sig
iked: Reject malformed and out-of-state IKEv2 messages
A malicious or malformed IKEv2 peer could crash iked, or cause a
certificate validation verdict to be applied to the wrong peer
identity. Reject malformed DELETE payloads and EAP responses for
which no matching server state exists, and bind CA and OCSP verdicts
to the identity they were computed for.
Reported by Stefan Rinkes and acts1631kjv at proton me.
from hshoexer@; OK markus@
this is errata/7.9/027_iked.patch.sig
iked: Reject malformed and out-of-state IKEv2 messages
A malicious or malformed IKEv2 peer could crash iked, or cause a
certificate validation verdict to be applied to the wrong peer
identity. Reject malformed DELETE payloads and EAP responses for
which no matching server state exists, and bind CA and OCSP verdicts
to the identity they were computed for.
Reported by Stefan Rinkes and acts1631kjv at proton me.
from hshoexer@; OK markus@
this is errata/7.8/063_iked.patch.sig
Introduce in-kernel 'shmid_ds_kern' structure where `shm_nattch' has the
type of uint64_t. The original 'shmid_ds' used to deliver data to the
userland, so API/ABI is not broken. The delivered `shm_nattch' value is
clamped with SHRT_MAX.
from mvs@; OK deraadt@
Do missing shmid_ds_kern to shmid_ds conversion in the IPC_SET case of
sys_shmctl().
from deraadt@
the visual hint for sys_shmctl_args became incorrect with the _kernl adjustment
from deraadt@
this is errata/7.9/026_sysvipc.patch.sig
Introduce in-kernel 'shmid_ds_kern' structure where `shm_nattch' has the
type of uint64_t. The original 'shmid_ds' used to deliver data to the
userland, so API/ABI is not broken. The delivered `shm_nattch' value is
clamped with SHRT_MAX.
from mvs@; OK deraadt@
Do missing shmid_ds_kern to shmid_ds conversion in the IPC_SET case of
sys_shmctl().
from deraadt@
the visual hint for sys_shmctl_args became incorrect with the _kernl adjustment
from deraadt@
this is errata/7.8/062_sysvipc.patch.sig
In ipcs(1) use shm_cpid to determine whether a shared memory segment is in use.
As since kern_sysctl.c r1.490 shm_internal is always NULL.
from dgl@; OK deraadt@
sysctl KERN_SYSVIPC_SEM_INFO was leaking the sem_base kernel pointer to userland.
This was used by ipcs(1), so change to use sem_ctime instead to decide if it
should show the semaphore.
Found independently by me and a report from Bruce Dang of Calif.io (minutes apart).
from dgl@; OK deraadt@
this is errata/7.8/062_sysvipc.patch.sig
In sysctl KERN_PROC_ARGS "cnt" is an int, read directly from a userspace
process. The while loop has a "cnt > 0" check, but on 32-bit platforms a value
can overflow and result in the querying process having data written past the
supplied buffer. Limit the number of elements in the array to ARG_MAX.
from dgl@; OK deraadt@
this is errata/7.9/025_procargs.patch.sig
In sysctl KERN_PROC_ARGS "cnt" is an int, read directly from a userspace
process. The while loop has a "cnt > 0" check, but on 32-bit platforms a value
can overflow and result in the querying process having data written past the
supplied buffer. Limit the number of elements in the array to ARG_MAX.
from dgl@; OK deraadt@
this is errata/7.8/061_procargs.patch.sig
Sprinkle tags to be able to navigate to [no] keywords; OK schwarze
None of these were reachable by tags, e.g. ":t log" wouldn't jump to the
"log" keyword's definition because auf how auto-tagging works;
see `man -Otag=Tg mdoc' for details.
