From owner-svn-src-stable-7@FreeBSD.ORG Wed Sep 28 08:47:18 2011 Return-Path: Delivered-To: svn-src-stable-7@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 7B4241065673; Wed, 28 Sep 2011 08:47:18 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 675668FC20; Wed, 28 Sep 2011 08:47:18 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id p8S8lI7l063637; Wed, 28 Sep 2011 08:47:18 GMT (envelope-from bz@svn.freebsd.org) Received: (from bz@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id p8S8lIRf063633; Wed, 28 Sep 2011 08:47:18 GMT (envelope-from bz@svn.freebsd.org) Message-Id: <201109280847.p8S8lIRf063633@svn.freebsd.org> From: "Bjoern A. Zeeb" Date: Wed, 28 Sep 2011 08:47:18 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org X-SVN-Group: stable-7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r225827 - head/sys/kern head/usr.bin/compress head/usr.bin/gzip releng/7.3 releng/7.3/sys/conf releng/7.3/sys/kern releng/7.3/usr.bin/compress releng/7.3/usr.bin/gzip releng/7.4 releng/... X-BeenThere: svn-src-stable-7@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 7-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Sep 2011 08:47:18 -0000 Author: bz Date: Wed Sep 28 08:47:17 2011 New Revision: 225827 URL: http://svn.freebsd.org/changeset/base/225827 Log: Fix handling of corrupt compress(1)ed data. [11:04] Add missing length checks on unix socket addresses. [11:05] Approved by: so (cperciva) Approved by: re (kensmith) Security: FreeBSD-SA-11:04.compress Security: CVE-2011-2895 [11:04] Security: FreeBSD-SA-11:05.unix Modified: stable/7/sys/kern/uipc_usrreq.c stable/7/usr.bin/compress/zopen.c stable/7/usr.bin/gzip/zuncompress.c Changes in other areas also in this revision: Modified: head/sys/kern/uipc_usrreq.c head/usr.bin/compress/zopen.c head/usr.bin/gzip/zuncompress.c releng/7.3/UPDATING releng/7.3/sys/conf/newvers.sh releng/7.3/sys/kern/uipc_usrreq.c releng/7.3/usr.bin/compress/zopen.c releng/7.3/usr.bin/gzip/zuncompress.c releng/7.4/UPDATING releng/7.4/sys/conf/newvers.sh releng/7.4/sys/kern/uipc_usrreq.c releng/7.4/usr.bin/compress/zopen.c releng/7.4/usr.bin/gzip/zuncompress.c releng/8.1/UPDATING releng/8.1/sys/conf/newvers.sh releng/8.1/sys/kern/uipc_usrreq.c releng/8.1/usr.bin/compress/zopen.c releng/8.1/usr.bin/gzip/zuncompress.c releng/8.2/UPDATING releng/8.2/sys/conf/newvers.sh releng/8.2/sys/kern/uipc_usrreq.c releng/8.2/usr.bin/compress/zopen.c releng/8.2/usr.bin/gzip/zuncompress.c stable/8/sys/kern/uipc_usrreq.c stable/8/usr.bin/compress/zopen.c stable/8/usr.bin/gzip/zuncompress.c stable/9/sys/kern/uipc_usrreq.c stable/9/usr.bin/compress/zopen.c stable/9/usr.bin/gzip/zuncompress.c Modified: stable/7/sys/kern/uipc_usrreq.c ============================================================================== --- stable/7/sys/kern/uipc_usrreq.c Wed Sep 28 08:19:45 2011 (r225826) +++ stable/7/sys/kern/uipc_usrreq.c Wed Sep 28 08:47:17 2011 (r225827) @@ -395,6 +395,8 @@ uipc_bind(struct socket *so, struct sock unp = sotounpcb(so); KASSERT(unp != NULL, ("uipc_bind: unp == NULL")); + if (soun->sun_len > sizeof(struct sockaddr_un)) + return (EINVAL); namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path); if (namelen <= 0) return (EINVAL); @@ -1142,6 +1144,8 @@ unp_connect(struct socket *so, struct so unp = sotounpcb(so); KASSERT(unp != NULL, ("unp_connect: unp == NULL")); + if (nam->sa_len > sizeof(struct sockaddr_un)) + return (EINVAL); len = nam->sa_len - offsetof(struct sockaddr_un, sun_path); if (len <= 0) return (EINVAL); Modified: stable/7/usr.bin/compress/zopen.c ============================================================================== --- stable/7/usr.bin/compress/zopen.c Wed Sep 28 08:19:45 2011 (r225826) +++ stable/7/usr.bin/compress/zopen.c Wed Sep 28 08:47:17 2011 (r225827) @@ -490,7 +490,7 @@ zread(void *cookie, char *rbp, int num) block_compress = maxbits & BLOCK_MASK; maxbits &= BIT_MASK; maxmaxcode = 1L << maxbits; - if (maxbits > BITS) { + if (maxbits > BITS || maxbits < 12) { errno = EFTYPE; return (-1); } @@ -517,17 +517,28 @@ zread(void *cookie, char *rbp, int num) for (code = 255; code >= 0; code--) tab_prefixof(code) = 0; clear_flg = 1; - free_ent = FIRST - 1; - if ((code = getcode(zs)) == -1) /* O, untimely death! */ - break; + free_ent = FIRST; + oldcode = -1; + continue; } incode = code; - /* Special case for KwKwK string. */ + /* Special case for kWkWk string. */ if (code >= free_ent) { + if (code > free_ent || oldcode == -1) { + /* Bad stream. */ + errno = EINVAL; + return (-1); + } *stackp++ = finchar; code = oldcode; } + /* + * The above condition ensures that code < free_ent. + * The construction of tab_prefixof in turn guarantees that + * each iteration decreases code and therefore stack usage is + * bound by 1 << BITS - 256. + */ /* Generate output characters in reverse order. */ while (code >= 256) { @@ -544,7 +555,7 @@ middle: do { } while (stackp > de_stack); /* Generate the new entry. */ - if ((code = free_ent) < maxmaxcode) { + if ((code = free_ent) < maxmaxcode && oldcode != -1) { tab_prefixof(code) = (u_short) oldcode; tab_suffixof(code) = finchar; free_ent = code + 1; Modified: stable/7/usr.bin/gzip/zuncompress.c ============================================================================== --- stable/7/usr.bin/gzip/zuncompress.c Wed Sep 28 08:19:45 2011 (r225826) +++ stable/7/usr.bin/gzip/zuncompress.c Wed Sep 28 08:47:17 2011 (r225827) @@ -247,7 +247,7 @@ zread(void *cookie, char *rbp, int num) zs->zs_block_compress = zs->zs_maxbits & BLOCK_MASK; zs->zs_maxbits &= BIT_MASK; zs->zs_maxmaxcode = 1L << zs->zs_maxbits; - if (zs->zs_maxbits > BITS) { + if (zs->zs_maxbits > BITS || zs->zs_maxbits < 12) { errno = EFTYPE; return (-1); } @@ -259,13 +259,7 @@ zread(void *cookie, char *rbp, int num) } zs->zs_free_ent = zs->zs_block_compress ? FIRST : 256; - zs->u.r.zs_finchar = zs->u.r.zs_oldcode = getcode(zs); - if (zs->u.r.zs_oldcode == -1) /* EOF already? */ - return (0); /* Get out of here */ - - /* First code must be 8 bits = char. */ - *bp++ = (u_char)zs->u.r.zs_finchar; - count--; + zs->u.r.zs_oldcode = -1; zs->u.r.zs_stackp = de_stack; while ((zs->u.r.zs_code = getcode(zs)) > -1) { @@ -275,17 +269,29 @@ zread(void *cookie, char *rbp, int num) zs->u.r.zs_code--) tab_prefixof(zs->u.r.zs_code) = 0; zs->zs_clear_flg = 1; - zs->zs_free_ent = FIRST - 1; - if ((zs->u.r.zs_code = getcode(zs)) == -1) /* O, untimely death! */ - break; + zs->zs_free_ent = FIRST; + zs->u.r.zs_oldcode = -1; + continue; } zs->u.r.zs_incode = zs->u.r.zs_code; /* Special case for KwKwK string. */ if (zs->u.r.zs_code >= zs->zs_free_ent) { + if (zs->u.r.zs_code > zs->zs_free_ent || + zs->u.r.zs_oldcode == -1) { + /* Bad stream. */ + errno = EINVAL; + return (-1); + } *zs->u.r.zs_stackp++ = zs->u.r.zs_finchar; zs->u.r.zs_code = zs->u.r.zs_oldcode; } + /* + * The above condition ensures that code < free_ent. + * The construction of tab_prefixof in turn guarantees that + * each iteration decreases code and therefore stack usage is + * bound by 1 << BITS - 256. + */ /* Generate output characters in reverse order. */ while (zs->u.r.zs_code >= 256) { @@ -302,7 +308,8 @@ middle: do { } while (zs->u.r.zs_stackp > de_stack); /* Generate the new entry. */ - if ((zs->u.r.zs_code = zs->zs_free_ent) < zs->zs_maxmaxcode) { + if ((zs->u.r.zs_code = zs->zs_free_ent) < zs->zs_maxmaxcode && + zs->u.r.zs_oldcode != -1) { tab_prefixof(zs->u.r.zs_code) = (u_short) zs->u.r.zs_oldcode; tab_suffixof(zs->u.r.zs_code) = zs->u.r.zs_finchar; zs->zs_free_ent = zs->u.r.zs_code + 1; From owner-svn-src-stable-7@FreeBSD.ORG Thu Sep 29 18:42:44 2011 Return-Path: Delivered-To: svn-src-stable-7@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 916BE106567F; Thu, 29 Sep 2011 18:42:44 +0000 (UTC) (envelope-from mav@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 7F7C58FC1B; Thu, 29 Sep 2011 18:42:44 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id p8TIgiYO034836; Thu, 29 Sep 2011 18:42:44 GMT (envelope-from mav@svn.freebsd.org) Received: (from mav@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id p8TIgihh034832; Thu, 29 Sep 2011 18:42:44 GMT (envelope-from mav@svn.freebsd.org) Message-Id: <201109291842.p8TIgihh034832@svn.freebsd.org> From: Alexander Motin Date: Thu, 29 Sep 2011 18:42:44 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org X-SVN-Group: stable-7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r225881 - in stable/7: sbin/geom/class/mirror sys/geom/mirror X-BeenThere: svn-src-stable-7@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 7-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Sep 2011 18:42:44 -0000 Author: mav Date: Thu Sep 29 18:42:44 2011 New Revision: 225881 URL: http://svn.freebsd.org/changeset/base/225881 Log: MFC r196879: Add support for changing providers priority. PR: kern/160811 Modified: stable/7/sbin/geom/class/mirror/geom_mirror.c stable/7/sbin/geom/class/mirror/gmirror.8 stable/7/sys/geom/mirror/g_mirror_ctl.c Directory Properties: stable/7/sbin/geom/ (props changed) stable/7/sbin/geom/class/journal/ (props changed) stable/7/sbin/geom/class/label/ (props changed) stable/7/sbin/geom/class/part/ (props changed) stable/7/sbin/geom/class/stripe/ (props changed) stable/7/sbin/geom/misc/ (props changed) stable/7/sys/ (props changed) stable/7/sys/cddl/contrib/opensolaris/ (props changed) stable/7/sys/contrib/dev/acpica/ (props changed) stable/7/sys/contrib/pf/ (props changed) Modified: stable/7/sbin/geom/class/mirror/geom_mirror.c ============================================================================== --- stable/7/sbin/geom/class/mirror/geom_mirror.c Thu Sep 29 18:12:40 2011 (r225880) +++ stable/7/sbin/geom/class/mirror/geom_mirror.c Thu Sep 29 18:42:44 2011 (r225881) @@ -1,5 +1,5 @@ /*- - * Copyright (c) 2004-2005 Pawel Jakub Dawidek + * Copyright (c) 2004-2009 Pawel Jakub Dawidek * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -41,13 +41,12 @@ __FBSDID("$FreeBSD$"); #include #include - uint32_t lib_version = G_LIB_VERSION; uint32_t version = G_MIRROR_VERSION; static char label_balance[] = "load", configure_balance[] = "none"; static intmax_t label_slice = 4096, configure_slice = -1; -static intmax_t insert_priority = 0; +static intmax_t insert_priority = 0, configure_priority = -1; static void mirror_main(struct gctl_req *req, unsigned flags); static void mirror_activate(struct gctl_req *req); @@ -71,10 +70,12 @@ struct g_command class_commands[] = { { 'F', "nofailsync", NULL, G_TYPE_BOOL }, { 'h', "hardcode", NULL, G_TYPE_BOOL }, { 'n', "noautosync", NULL, G_TYPE_BOOL }, + { 'p', "priority", &configure_priority, G_TYPE_NUMBER }, { 's', "slice", &configure_slice, G_TYPE_NUMBER }, G_OPT_SENTINEL }, - NULL, "[-adfFhnv] [-b balance] [-s slice] name" + NULL, "[-adfFhnv] [-b balance] [-s slice] name\n" + "[-v] -p priority name prov" }, { "deactivate", G_FLAG_VERBOSE, NULL, G_NULL_OPTS, NULL, "[-v] name prov ..." Modified: stable/7/sbin/geom/class/mirror/gmirror.8 ============================================================================== --- stable/7/sbin/geom/class/mirror/gmirror.8 Thu Sep 29 18:12:40 2011 (r225880) +++ stable/7/sbin/geom/class/mirror/gmirror.8 Thu Sep 29 18:42:44 2011 (r225881) @@ -1,4 +1,4 @@ -.\" Copyright (c) 2004-2005 Pawel Jakub Dawidek +.\" Copyright (c) 2004-2009 Pawel Jakub Dawidek .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without @@ -24,7 +24,7 @@ .\" .\" $FreeBSD$ .\" -.Dd November 1, 2006 +.Dd August 1, 2009 .Dt GMIRROR 8 .Os .Sh NAME @@ -49,6 +49,12 @@ .Op Fl s Ar slice .Ar name .Nm +.Cm configure +.Op Fl v +.Fl p Ar priority +.Ar name +.Ar prov +.Nm .Cm rebuild .Op Fl v .Ar name @@ -115,8 +121,8 @@ indicates an action to be performed: .It Cm label Create a mirror. The order of components is important, because a component's priority is based on its position -(starting from 0). -The component with the biggest priority is used by the +(starting from 0 to 255). +The component with the biggest priority (the lowest number) is used by the .Cm prefer balance algorithm and is also used as a master component when resynchronization is needed, @@ -159,7 +165,7 @@ Clear metadata on the given providers. Configure the given device. .Pp Additional options include: -.Bl -tag -width ".Fl b Ar balance" +.Bl -tag -width ".Fl p Ar priority" .It Fl a Turn on autosynchronization of stale components. .It Fl b Ar balance @@ -175,6 +181,9 @@ Assumes device is in consistent state. Hardcode providers' names in metadata. .It Fl n Turn off autosynchronization of stale components. +.It Fl p Ar priority +Specifies priority for the given component +.Ar prov . .It Fl s Ar slice Specifies slice size for .Cm split Modified: stable/7/sys/geom/mirror/g_mirror_ctl.c ============================================================================== --- stable/7/sys/geom/mirror/g_mirror_ctl.c Thu Sep 29 18:12:40 2011 (r225880) +++ stable/7/sys/geom/mirror/g_mirror_ctl.c Thu Sep 29 18:42:44 2011 (r225881) @@ -1,5 +1,5 @@ /*- - * Copyright (c) 2004-2006 Pawel Jakub Dawidek + * Copyright (c) 2004-2009 Pawel Jakub Dawidek * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -93,19 +93,19 @@ g_mirror_ctl_configure(struct gctl_req * { struct g_mirror_softc *sc; struct g_mirror_disk *disk; - const char *name, *balancep; - intmax_t *slicep; + const char *name, *balancep, *prov; + intmax_t *slicep, *priority; uint32_t slice; uint8_t balance; int *autosync, *noautosync, *failsync, *nofailsync, *hardcode, *dynamic; - int *nargs, do_sync = 0, dirty = 1; + int *nargs, do_sync = 0, dirty = 1, do_priority = 0; nargs = gctl_get_paraml(req, "nargs", sizeof(*nargs)); if (nargs == NULL) { gctl_error(req, "No '%s' argument.", "nargs"); return; } - if (*nargs != 1) { + if (*nargs != 1 && *nargs != 2) { gctl_error(req, "Invalid number of arguments."); return; } @@ -149,6 +149,29 @@ g_mirror_ctl_configure(struct gctl_req * gctl_error(req, "No '%s' argument.", "dynamic"); return; } + priority = gctl_get_paraml(req, "priority", sizeof(*priority)); + if (priority == NULL) { + gctl_error(req, "No '%s' argument.", "priority"); + return; + } + if (*priority < -1 || *priority > 255) { + gctl_error(req, "Priority range is 0 to 255, %jd given", + *priority); + return; + } + /* + * Since we have a priority, we also need a provider now. + * Note: be WARNS safe, by always assigning prov and only throw an + * error if *priority != -1. + */ + prov = gctl_get_asciiparam(req, "arg1"); + if (*priority > -1) { + if (prov == NULL) { + gctl_error(req, "Priority needs a disk name"); + return; + } + do_priority = 1; + } if (*autosync && *noautosync) { gctl_error(req, "'%s' and '%s' specified.", "autosync", "noautosync"); @@ -189,19 +212,32 @@ g_mirror_ctl_configure(struct gctl_req * slice = sc->sc_slice; else slice = *slicep; - if (g_mirror_ndisks(sc, -1) < sc->sc_ndisks) { + /* Enforce usage() of -p not allowing any other options. */ + if (do_priority && (*autosync || *noautosync || *failsync || + *nofailsync || *hardcode || *dynamic || *slicep != -1 || + strcmp(balancep, "none") != 0)) { sx_xunlock(&sc->sc_lock); - gctl_error(req, "Not all disks connected. Try 'forget' command " - "first."); + gctl_error(req, "only -p accepted when setting priority"); return; } if (sc->sc_balance == balance && sc->sc_slice == slice && !*autosync && !*noautosync && !*failsync && !*nofailsync && !*hardcode && - !*dynamic) { + !*dynamic && !do_priority) { sx_xunlock(&sc->sc_lock); gctl_error(req, "Nothing has changed."); return; } + if ((!do_priority && *nargs != 1) || (do_priority && *nargs != 2)) { + sx_xunlock(&sc->sc_lock); + gctl_error(req, "Invalid number of arguments."); + return; + } + if (g_mirror_ndisks(sc, -1) < sc->sc_ndisks) { + sx_xunlock(&sc->sc_lock); + gctl_error(req, "Not all disks connected. Try 'forget' command " + "first."); + return; + } sc->sc_balance = balance; sc->sc_slice = slice; if ((sc->sc_flags & G_MIRROR_DEVICE_FLAG_NOAUTOSYNC) != 0) { @@ -223,6 +259,23 @@ g_mirror_ctl_configure(struct gctl_req * } } LIST_FOREACH(disk, &sc->sc_disks, d_next) { + /* + * Handle priority first, since we only need one disk, do one + * operation on it and then we're done. No need to check other + * flags, as usage doesn't allow it. + */ + if (do_priority) { + if (strcmp(disk->d_name, prov) == 0) { + if (disk->d_priority == *priority) + gctl_error(req, "Nothing has changed."); + else { + disk->d_priority = *priority; + g_mirror_update_metadata(disk); + } + break; + } + continue; + } if (do_sync) { if (disk->d_state == G_MIRROR_DISK_STATE_SYNCHRONIZING) disk->d_flags &= ~G_MIRROR_DISK_FLAG_FORCE_SYNC;