[src/netbsd-8]: src/sys/compat/ibcs2 Pull up following revision(s) (requested...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/a9a73589d20d
branches:  netbsd-8
changeset: 850916:a9a73589d20d
user:      martin <martin%NetBSD.org@localhost>
date:      Tue Aug 08 16:21:35 2017 +0000

description:
Pull up following revision(s) (requested by spz in ticket #191):
        sys/compat/ibcs2/ibcs2_ioctl.c: revision 1.46
        sys/compat/ibcs2/ibcs2_stat.c: revision 1.50
        sys/compat/ibcs2/ibcs2_exec_coff.c: revision 1.27
        sys/compat/ibcs2/ibcs2_exec_coff.c: revision 1.28
        sys/compat/ibcs2/ibcs2_exec_coff.c: revision 1.29
        sys/compat/ibcs2/ibcs2_stat.c: revision 1.49
Check for NUL termination within the buffer we have.
>From Ilja Van Sprundel.
Make sure we have enough space in the buffer before reading it.
>From Ilja Van Sprundel.
Make sure we move forward over the buffer.
>From Ilja Van Sprundel.
Zero buffers in ibcs2 ioctl to avoid disclosing stack to userland.
>From Ilja Van Sprundel.
Don't drop vnode ref until we're done with mount in ibcs2_stat(v)fs.
Nothing else guarantees the mount will stick around.
>From Ilja Van Sprundel.
Little happy on the commit trigger.  Actually use the out label.

diffstat:

 sys/compat/ibcs2/ibcs2_exec_coff.c |  12 +++++++++---
 sys/compat/ibcs2/ibcs2_ioctl.c     |   7 +++++--
 sys/compat/ibcs2/ibcs2_stat.c      |  26 +++++++++++++++-----------
 3 files changed, 29 insertions(+), 16 deletions(-)

diffs (133 lines):

diff -r fec519d8e255 -r a9a73589d20d sys/compat/ibcs2/ibcs2_exec_coff.c
--- a/sys/compat/ibcs2/ibcs2_exec_coff.c        Tue Aug 08 16:12:56 2017 +0000
+++ b/sys/compat/ibcs2/ibcs2_exec_coff.c        Tue Aug 08 16:21:35 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $      */
+/*     $NetBSD: ibcs2_exec_coff.c,v 1.26.22.1 2017/08/08 16:21:35 martin Exp $ */
 
 /*
  * Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.26.22.1 2017/08/08 16:21:35 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -454,6 +454,10 @@
                }
                bufp = tbuf;
                while (len) {
+                       if (len < sizeof(struct coff_slhdr)) {
+                               free(tbuf, M_TEMP);
+                               return ENOEXEC;
+                       }
                        slhdr = (struct coff_slhdr *)bufp;
 
                        if (slhdr->path_index > LONG_MAX / sizeof(long) ||
@@ -465,7 +469,9 @@
                        /* path_index = slhdr->path_index * sizeof(long); */
                        entry_len = slhdr->entry_len * sizeof(long);
 
-                       if (entry_len > len) {
+                       if (entry_len < sizeof(struct coff_slhdr) ||
+                           entry_len > len ||
+                           strnlen(slhdr->sl_name, entry_len) == entry_len) {
                                free(tbuf, M_TEMP);
                                return ENOEXEC;
                        }
diff -r fec519d8e255 -r a9a73589d20d sys/compat/ibcs2/ibcs2_ioctl.c
--- a/sys/compat/ibcs2/ibcs2_ioctl.c    Tue Aug 08 16:12:56 2017 +0000
+++ b/sys/compat/ibcs2/ibcs2_ioctl.c    Tue Aug 08 16:21:35 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $        */
+/*     $NetBSD: ibcs2_ioctl.c,v 1.45.76.1 2017/08/08 16:21:35 martin Exp $     */
 
 /*
  * Copyright (c) 1994, 1995 Scott Bartram
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45.76.1 2017/08/08 16:21:35 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -402,8 +402,10 @@
                if ((error = (*ctl)(fp, TIOCGETA, &bts)) != 0)
                        goto out;
 
+               memset(&sts, 0, sizeof(sts));
                btios2stios(&bts, &sts);
                if (SCARG(uap, cmd) == IBCS2_TCGETA) {
+                       memset(&st, 0, sizeof(st));
                        stios2stio(&sts, &st);
                        error = copyout(&st, SCARG(uap, data), sizeof(st));
                        if (error)
@@ -559,6 +561,7 @@
 
        fd_putfile(SCARG(uap, fd));
 
+       memset(&itb, 0, sizeof(itb));
        itb.sg_ispeed = tb.sg_ispeed;
        itb.sg_ospeed = tb.sg_ospeed;
        itb.sg_erase = tb.sg_erase;
diff -r fec519d8e255 -r a9a73589d20d sys/compat/ibcs2/ibcs2_stat.c
--- a/sys/compat/ibcs2/ibcs2_stat.c     Tue Aug 08 16:12:56 2017 +0000
+++ b/sys/compat/ibcs2/ibcs2_stat.c     Tue Aug 08 16:21:35 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ibcs2_stat.c,v 1.48 2014/09/05 09:21:54 matt Exp $     */
+/*     $NetBSD: ibcs2_stat.c,v 1.48.12.1 2017/08/08 16:21:35 martin Exp $      */
 /*
  * Copyright (c) 1995, 1998 Scott Bartram
  * All rights reserved.
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.48 2014/09/05 09:21:54 matt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.48.12.1 2017/08/08 16:21:35 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -147,11 +147,13 @@
                return (error);
        mp = vp->v_mount;
        sp = &mp->mnt_stat;
+       if ((error = VFS_STATVFS(mp, sp)) != 0)
+               goto out;
+       sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
+       error = cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+out:
        vrele(vp);
-       if ((error = VFS_STATVFS(mp, sp)) != 0)
-               return (error);
-       sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
-       return cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+       return (error);
 }
 
 int
@@ -200,12 +202,14 @@
                return (error);
        mp = vp->v_mount;
        sp = &mp->mnt_stat;
+       if ((error = VFS_STATVFS(mp, sp)) != 0)
+               goto out;
+       sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
+       error = cvt_statvfs(sp, (void *)SCARG(uap, buf),
+           sizeof(struct ibcs2_statvfs));
+out:
        vrele(vp);
-       if ((error = VFS_STATVFS(mp, sp)) != 0)
-               return (error);
-       sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
-       return cvt_statvfs(sp, (void *)SCARG(uap, buf),
-                          sizeof(struct ibcs2_statvfs));
+       return error;
 }
 
 int