[src/netbsd-7-0]: src/sys/compat/ibcs2 Pull up following revision(s) (request...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f20b8342585e
branches:  netbsd-7-0
changeset: 801358:f20b8342585e
user:      snj <snj%NetBSD.org@localhost>
date:      Sat Aug 12 04:08:25 2017 +0000

description:
Pull up following revision(s) (requested by mrg in ticket #1477):
        sys/compat/ibcs2/ibcs2_exec_coff.c: revision 1.27-1.29
        sys/compat/ibcs2/ibcs2_ioctl.c: revision 1.46
        sys/compat/ibcs2/ibcs2_stat.c: revision 1.49-1.50
Check for NUL termination within the buffer we have.
>From Ilja Van Sprundel.
--
Make sure we have enough space in the buffer before reading it.
>From Ilja Van Sprundel.
--
Make sure we move forward over the buffer.
>From Ilja Van Sprundel.
--
Zero buffers in ibcs2 ioctl to avoid disclosing stack to userland.
>From Ilja Van Sprundel.
--
Don't drop vnode ref until we're done with mount in ibcs2_stat(v)fs.
Nothing else guarantees the mount will stick around.
>From Ilja Van Sprundel.
--
Little happy on the commit trigger.  Actually use the out label.

diffstat:

 sys/compat/ibcs2/ibcs2_exec_coff.c |  12 +++++++++---
 sys/compat/ibcs2/ibcs2_ioctl.c     |   7 +++++--
 sys/compat/ibcs2/ibcs2_stat.c      |  26 +++++++++++++++-----------
 3 files changed, 29 insertions(+), 16 deletions(-)

diffs (133 lines):

diff -r bc07d07c546a -r f20b8342585e sys/compat/ibcs2/ibcs2_exec_coff.c
--- a/sys/compat/ibcs2/ibcs2_exec_coff.c        Sat Aug 12 03:59:24 2017 +0000
+++ b/sys/compat/ibcs2/ibcs2_exec_coff.c        Sat Aug 12 04:08:25 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $      */
+/*     $NetBSD: ibcs2_exec_coff.c,v 1.26.8.1 2017/08/12 04:08:25 snj Exp $     */
 
 /*
  * Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.26.8.1 2017/08/12 04:08:25 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -454,6 +454,10 @@
                }
                bufp = tbuf;
                while (len) {
+                       if (len < sizeof(struct coff_slhdr)) {
+                               free(tbuf, M_TEMP);
+                               return ENOEXEC;
+                       }
                        slhdr = (struct coff_slhdr *)bufp;
 
                        if (slhdr->path_index > LONG_MAX / sizeof(long) ||
@@ -465,7 +469,9 @@
                        /* path_index = slhdr->path_index * sizeof(long); */
                        entry_len = slhdr->entry_len * sizeof(long);
 
-                       if (entry_len > len) {
+                       if (entry_len < sizeof(struct coff_slhdr) ||
+                           entry_len > len ||
+                           strnlen(slhdr->sl_name, entry_len) == entry_len) {
                                free(tbuf, M_TEMP);
                                return ENOEXEC;
                        }
diff -r bc07d07c546a -r f20b8342585e sys/compat/ibcs2/ibcs2_ioctl.c
--- a/sys/compat/ibcs2/ibcs2_ioctl.c    Sat Aug 12 03:59:24 2017 +0000
+++ b/sys/compat/ibcs2/ibcs2_ioctl.c    Sat Aug 12 04:08:25 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $        */
+/*     $NetBSD: ibcs2_ioctl.c,v 1.45.62.1 2017/08/12 04:08:25 snj Exp $        */
 
 /*
  * Copyright (c) 1994, 1995 Scott Bartram
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45.62.1 2017/08/12 04:08:25 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -402,8 +402,10 @@
                if ((error = (*ctl)(fp, TIOCGETA, &bts)) != 0)
                        goto out;
 
+               memset(&sts, 0, sizeof(sts));
                btios2stios(&bts, &sts);
                if (SCARG(uap, cmd) == IBCS2_TCGETA) {
+                       memset(&st, 0, sizeof(st));
                        stios2stio(&sts, &st);
                        error = copyout(&st, SCARG(uap, data), sizeof(st));
                        if (error)
@@ -559,6 +561,7 @@
 
        fd_putfile(SCARG(uap, fd));
 
+       memset(&itb, 0, sizeof(itb));
        itb.sg_ispeed = tb.sg_ispeed;
        itb.sg_ospeed = tb.sg_ospeed;
        itb.sg_erase = tb.sg_erase;
diff -r bc07d07c546a -r f20b8342585e sys/compat/ibcs2/ibcs2_stat.c
--- a/sys/compat/ibcs2/ibcs2_stat.c     Sat Aug 12 03:59:24 2017 +0000
+++ b/sys/compat/ibcs2/ibcs2_stat.c     Sat Aug 12 04:08:25 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ibcs2_stat.c,v 1.47 2009/06/29 05:08:16 dholland Exp $ */
+/*     $NetBSD: ibcs2_stat.c,v 1.47.40.1 2017/08/12 04:08:25 snj Exp $ */
 /*
  * Copyright (c) 1995, 1998 Scott Bartram
  * All rights reserved.
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.47 2009/06/29 05:08:16 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.47.40.1 2017/08/12 04:08:25 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -147,11 +147,13 @@
                return (error);
        mp = vp->v_mount;
        sp = &mp->mnt_stat;
+       if ((error = VFS_STATVFS(mp, sp)) != 0)
+               goto out;
+       sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
+       error = cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+out:
        vrele(vp);
-       if ((error = VFS_STATVFS(mp, sp)) != 0)
-               return (error);
-       sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
-       return cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+       return (error);
 }
 
 int
@@ -200,12 +202,14 @@
                return (error);
        mp = vp->v_mount;
        sp = &mp->mnt_stat;
+       if ((error = VFS_STATVFS(mp, sp)) != 0)
+               goto out;
+       sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
+       error = cvt_statvfs(sp, (void *)SCARG(uap, buf),
+           sizeof(struct ibcs2_statvfs));
+out:
        vrele(vp);
-       if ((error = VFS_STATVFS(mp, sp)) != 0)
-               return (error);
-       sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
-       return cvt_statvfs(sp, (void *)SCARG(uap, buf),
-                          sizeof(struct ibcs2_statvfs));
+       return error;
 }
 
 int