Do not use dangling pointer in igmp multicast.
Due to different lifetime of interfaces and multicast address
structure, the pointer to router info could get invalid. Do not
cache the pointer of struct router_info in struct in_multi. Instead
always walk the list with appropriate lock.
Reported-by: syzbot+4a08786178b626883543 at syzkaller.appspotmail.com
OK gnezdo@ who provided a simmilar fix; OK claudio@
SEV-SNP: sysctl to indicate virtualization mode
The sysctl indicates wether we are a host or a guest. In the latter
case show which SEV mode is if any.
ok mlarkin@
SEV-SNP: Log SEV-SNP guestmode
NB: The definition SEV_STAT_SNP_ACTIVE is straight from the AMD
documentation. The use of "active" instead of "enabled" -- as with
the other definitions -- feels inconsistent. However, "SNP enabled"
in the context of SNP means the host system is able to run VMs using
SNP. And "SNP active" means, the guest is actually using SNP. And
not just e.g. SEV-ES.
ok mlarkin@
Print TLS and short read errors to stderr and not stdout
Code paths that are not only used in interactive mode should log to
stderr. Adjust some TLS and a short file read error to use warnx.
Diff by Pontus Stenetorp (pontus at stenetorp dot se)
OK deraadt@ tb@
Correct EMSGSIZE handling in msgbuf_read to retry without control message
In msgbuf_read() the EMSGSIZE handling needs to retry without the control
buffer so that the message is read without the fd and forcing the kernel
to close the buffer). Else the call will fail immediatly again and the
system will busy loop.
OK tb@
Change overflow check in ibuf_get_strbuf
ibuf_get_strbuf is too picky about the terminating NUL byte.
If the sender did not use ibuf_add_strbuf() then the buffer may
not be padded with 0 at the end. This triggers the EOVERFLOW case
even though the string is probably short enough.
Make ibuf_get_strbuf more robust by checking the string length.
If the string is shorter than the buffer pad the rest with 0. On
overflow force a '\0' byte at the end and return EOVERFLOW.
OK tb@
relayctl: switch to imsg_get_* API
Use imsg_get_data() with size validation instead of casting imsg->data
directly and imsg_get_type/len/id/pid() instead of imsg->hdr.* acc
Structs like rdr/table/host.... carry embedded string buffers like name, label.
When such a struct crosses a privilege boundary the receiver cannot Structs
that the string is actually NUL terminated, so force a '\0' in the last byte
after imsg_get_data(). Not strictly required here because relayd is the sender,
but a good habit for imsg consumers.
embedded string buffer hint by claudio@, OK claudio@
Move check of public key type against allowed algorithms to before
parsing of the key sent by the peer.
This removes at least some key parsing and verification paths from
the pre-auth attack surface.
Suggested by Christopher Paul Rohlf of Anthropic, ok deraadt@
vmd(8): restrict qcow2 cluster shifts at parse time.
Qcow2 minimum is 9 (512 bytes). Cap a maximum at 21 (2 MiB).
Report and diff by Andrew Griffiths.
ok hshoexer@
vmd(8): reject short qcow2 l2 metadata reads.
Prevents use of partially initialized buffer if the read is short.
Report and diff by Andrew Griffiths.
ok hshoexer@
