[src/netbsd-9]: src/sys/net Pull up the following revisions(s) (requested by ...

[sborrill <sborrill%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2bf5cc0bf990
branches:  netbsd-9
changeset: 365946:2bf5cc0bf990
user:      sborrill <sborrill%NetBSD.org@localhost>
date:      Wed May 04 15:08:47 2022 +0000

description:
Pull up the following revisions(s) (requested by martin in ticket #1442):
        sys/net/if_pppoe.c:     revision 1.179

pppoe(4): fix CVE-2022-29867 - discovery phase local network
mbuf corruption.

diffstat:

 sys/net/if_pppoe.c |  15 +++++++++++++--
 1 files changed, 13 insertions(+), 2 deletions(-)

diffs (50 lines):

diff -r 58e0c89f3687 -r 2bf5cc0bf990 sys/net/if_pppoe.c
--- a/sys/net/if_pppoe.c        Wed Apr 27 16:54:20 2022 +0000
+++ b/sys/net/if_pppoe.c        Wed May 04 15:08:47 2022 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: if_pppoe.c,v 1.147.4.1 2020/02/13 19:40:05 martin Exp $ */
+/* $NetBSD: if_pppoe.c,v 1.147.4.2 2022/05/04 15:08:47 sborrill Exp $ */
 
 /*
  * Copyright (c) 2002, 2008 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.147.4.1 2020/02/13 19:40:05 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.147.4.2 2022/05/04 15:08:47 sborrill Exp $");
 
 #ifdef _KERNEL_OPT
 #include "pppoe.h"
@@ -887,6 +887,10 @@
                        }
                        sc->sc_ac_cookie_len = ac_cookie_len;
                        memcpy(sc->sc_ac_cookie, ac_cookie, ac_cookie_len);
+               } else if (sc->sc_ac_cookie) {
+                       free(sc->sc_ac_cookie, M_DEVBUF);
+                       sc->sc_ac_cookie = NULL;
+                       sc->sc_ac_cookie_len = 0;
                }
                if (relay_sid) {
                        if (sc->sc_relay_sid)
@@ -902,6 +906,10 @@
                        }
                        sc->sc_relay_sid_len = relay_sid_len;
                        memcpy(sc->sc_relay_sid, relay_sid, relay_sid_len);
+               } else if (sc->sc_relay_sid) {
+                       free(sc->sc_relay_sid, M_DEVBUF);
+                       sc->sc_relay_sid = NULL;
+                       sc->sc_relay_sid_len = 0;
                }
                memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest);
                callout_stop(&sc->sc_timeout);
@@ -1324,6 +1332,9 @@
 {
        struct mbuf *m;
 
+       if (len + sizeof(struct ether_header) > MCLBYTES)
+               return NULL;
+
        MGETHDR(m, M_DONTWAIT, MT_DATA);
        if (m == NULL)
                return NULL;