From owner-svn-src-releng@freebsd.org Wed Dec 19 17:52:57 2018 Return-Path: Delivered-To: svn-src-releng@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8AB78133E3BD; Wed, 19 Dec 2018 17:52:57 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 302CE8BEEB; Wed, 19 Dec 2018 17:52:57 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 1A34E19606; Wed, 19 Dec 2018 17:52:57 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id wBJHquD4094281; Wed, 19 Dec 2018 17:52:56 GMT (envelope-from emaste@FreeBSD.org) Received: (from emaste@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id wBJHquJ3094280; Wed, 19 Dec 2018 17:52:56 GMT (envelope-from emaste@FreeBSD.org) Message-Id: <201812191752.wBJHquJ3094280@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: emaste set sender to emaste@FreeBSD.org using -f From: Ed Maste Date: Wed, 19 Dec 2018 17:52:56 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r342224 - releng/11.2/sys/kern X-SVN-Group: releng X-SVN-Commit-Author: emaste X-SVN-Commit-Paths: releng/11.2/sys/kern X-SVN-Commit-Revision: 342224 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 302CE8BEEB X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.93 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-0.94)[-0.936,0]; NEURAL_HAM_LONG(-1.00)[-0.998,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US] X-BeenThere: svn-src-releng@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the release engineering / security commits to the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2018 17:52:57 -0000 Author: emaste Date: Wed Dec 19 17:52:56 2018 New Revision: 342224 URL: https://svnweb.freebsd.org/changeset/base/342224 Log: MFS11 r340290: Only clear a pending thread event if one is pending. This fixes a panic when attaching to an already-stopped process. Also do some other clean ups for control flow of sendsig section. Submitted by: markj Approved by: so Security: FreeBSD-EN-18:16.ptrace Sponsored by: The FreeBSD Foundation Modified: releng/11.2/sys/kern/sys_process.c Directory Properties: releng/11.2/ (props changed) Modified: releng/11.2/sys/kern/sys_process.c ============================================================================== --- releng/11.2/sys/kern/sys_process.c Wed Dec 19 17:52:09 2018 (r342223) +++ releng/11.2/sys/kern/sys_process.c Wed Dec 19 17:52:56 2018 (r342224) @@ -869,19 +869,13 @@ kern_ptrace(struct thread *td, int req, pid_t pid, voi } /* not currently stopped */ - if ((p->p_flag & (P_STOPPED_SIG | P_STOPPED_TRACE)) == 0 || + if ((p->p_flag & P_STOPPED_TRACE) == 0 || p->p_suspcount != p->p_numthreads || (p->p_flag & P_WAITED) == 0) { error = EBUSY; goto fail; } - if ((p->p_flag & P_STOPPED_TRACE) == 0) { - static int count = 0; - if (count++ == 0) - printf("P_STOPPED_TRACE not set.\n"); - } - /* OK */ break; } @@ -926,11 +920,28 @@ kern_ptrace(struct thread *td, int req, pid_t pid, voi if (p->p_pptr != td->td_proc) { proc_reparent(p, td->td_proc); } - data = SIGSTOP; CTR2(KTR_PTRACE, "PT_ATTACH: pid %d, oppid %d", p->p_pid, p->p_oppid); - goto sendsig; /* in PT_CONTINUE below */ + sx_xunlock(&proctree_lock); + proctree_locked = 0; + MPASS(p->p_xthread == NULL); + MPASS((p->p_flag & P_STOPPED_TRACE) == 0); + + /* + * If already stopped due to a stop signal, clear the + * existing stop before triggering a traced SIGSTOP. + */ + if ((p->p_flag & P_STOPPED_SIG) != 0) { + PROC_SLOCK(p); + p->p_flag &= ~(P_STOPPED_SIG | P_WAITED); + thread_unsuspend(p); + PROC_SUNLOCK(p); + } + + kern_psignal(p, SIGSTOP); + break; + case PT_CLEARSTEP: CTR2(KTR_PTRACE, "PT_CLEARSTEP: tid %d (pid %d)", td2->td_tid, p->p_pid); @@ -1117,8 +1128,10 @@ kern_ptrace(struct thread *td, int req, pid_t pid, voi sigqueue_delete(&td3->td_sigqueue, SIGSTOP); } - td3->td_dbgflags &= ~(TDB_XSIG | TDB_FSTP); + td3->td_dbgflags &= ~(TDB_XSIG | TDB_FSTP | + TDB_SUSPEND); } + if ((p->p_flag2 & P2_PTRACE_FSTP) != 0) { sigqueue_delete(&p->p_sigqueue, SIGSTOP); p->p_flag2 &= ~P2_PTRACE_FSTP; @@ -1129,54 +1142,45 @@ kern_ptrace(struct thread *td, int req, pid_t pid, voi break; } + sx_xunlock(&proctree_lock); + proctree_locked = 0; + sendsig: - /* + MPASS(proctree_locked == 0); + + /* * Clear the pending event for the thread that just * reported its event (p_xthread). This may not be * the thread passed to PT_CONTINUE, PT_STEP, etc. if * the debugger is resuming a different thread. + * + * Deliver any pending signal via the reporting thread. */ - td2 = p->p_xthread; - if (proctree_locked) { - sx_xunlock(&proctree_lock); - proctree_locked = 0; - } - p->p_xsig = data; + MPASS(p->p_xthread != NULL); + p->p_xthread->td_dbgflags &= ~TDB_XSIG; + p->p_xthread->td_xsig = data; p->p_xthread = NULL; - if ((p->p_flag & (P_STOPPED_SIG | P_STOPPED_TRACE)) != 0) { - /* deliver or queue signal */ - td2->td_dbgflags &= ~TDB_XSIG; - td2->td_xsig = data; + p->p_xsig = data; - /* - * P_WKILLED is insurance that a PT_KILL/SIGKILL always - * works immediately, even if another thread is - * unsuspended first and attempts to handle a different - * signal or if the POSIX.1b style signal queue cannot - * accommodate any new signals. - */ - if (data == SIGKILL) - p->p_flag |= P_WKILLED; + /* + * P_WKILLED is insurance that a PT_KILL/SIGKILL + * always works immediately, even if another thread is + * unsuspended first and attempts to handle a + * different signal or if the POSIX.1b style signal + * queue cannot accommodate any new signals. + */ + if (data == SIGKILL) + p->p_flag |= P_WKILLED; - if (req == PT_DETACH) { - FOREACH_THREAD_IN_PROC(p, td3) - td3->td_dbgflags &= ~TDB_SUSPEND; - } - /* - * unsuspend all threads, to not let a thread run, - * you should use PT_SUSPEND to suspend it before - * continuing process. - */ - PROC_SLOCK(p); - p->p_flag &= ~(P_STOPPED_TRACE|P_STOPPED_SIG|P_WAITED); - thread_unsuspend(p); - PROC_SUNLOCK(p); - if (req == PT_ATTACH) - kern_psignal(p, data); - } else { - if (data) - kern_psignal(p, data); - } + /* + * Unsuspend all threads. To leave a thread + * suspended, use PT_SUSPEND to suspend it before + * continuing the process. + */ + PROC_SLOCK(p); + p->p_flag &= ~(P_STOPPED_TRACE | P_STOPPED_SIG | P_WAITED); + thread_unsuspend(p); + PROC_SUNLOCK(p); break; case PT_WRITE_I: From owner-svn-src-releng@freebsd.org Wed Dec 19 18:00:59 2018 Return-Path: Delivered-To: svn-src-releng@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id CEBE5133E879; Wed, 19 Dec 2018 18:00:59 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 543E08C45A; Wed, 19 Dec 2018 18:00:59 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 43CF519631; Wed, 19 Dec 2018 18:00:59 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id wBJI0xdi094731; Wed, 19 Dec 2018 18:00:59 GMT (envelope-from emaste@FreeBSD.org) Received: (from emaste@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id wBJI0xms094730; Wed, 19 Dec 2018 18:00:59 GMT (envelope-from emaste@FreeBSD.org) Message-Id: <201812191800.wBJI0xms094730@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: emaste set sender to emaste@FreeBSD.org using -f From: Ed Maste Date: Wed, 19 Dec 2018 18:00:59 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r342225 - releng/11.2/sys/vm X-SVN-Group: releng X-SVN-Commit-Author: emaste X-SVN-Commit-Paths: releng/11.2/sys/vm X-SVN-Commit-Revision: 342225 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 543E08C45A X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.93 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-0.93)[-0.935,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US]; NEURAL_HAM_LONG(-1.00)[-0.998,0] X-BeenThere: svn-src-releng@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the release engineering / security commits to the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2018 18:01:00 -0000 Author: emaste Date: Wed Dec 19 18:00:58 2018 New Revision: 342225 URL: https://svnweb.freebsd.org/changeset/base/342225 Log: MFS11 r341401: Update the free page count when blacklisting pages. PR: 231296 Submitted by: markj Approved by: so Security: FreeBSD-EN-18:17.vm Sponsored by: The FreeBSD Foundation Modified: releng/11.2/sys/vm/vm_page.c Directory Properties: releng/11.2/ (props changed) Modified: releng/11.2/sys/vm/vm_page.c ============================================================================== --- releng/11.2/sys/vm/vm_page.c Wed Dec 19 17:52:56 2018 (r342224) +++ releng/11.2/sys/vm/vm_page.c Wed Dec 19 18:00:58 2018 (r342225) @@ -304,8 +304,10 @@ vm_page_blacklist_add(vm_paddr_t pa, bool verbose) mtx_lock(&vm_page_queue_free_mtx); ret = vm_phys_unfree_page(m); + if (ret != 0) + vm_phys_freecnt_adj(m, -1); mtx_unlock(&vm_page_queue_free_mtx); - if (ret) { + if (ret != 0) { TAILQ_INSERT_TAIL(&blacklist_head, m, listq); if (verbose) printf("Skipping page with pa 0x%jx\n", (uintmax_t)pa); From owner-svn-src-releng@freebsd.org Wed Dec 19 18:05:51 2018 Return-Path: Delivered-To: svn-src-releng@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2EF0C133EB0A; Wed, 19 Dec 2018 18:05:51 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id BDBC08C8AB; Wed, 19 Dec 2018 18:05:50 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A1130197C1; Wed, 19 Dec 2018 18:05:50 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id wBJI5oKG099673; Wed, 19 Dec 2018 18:05:50 GMT (envelope-from emaste@FreeBSD.org) Received: (from emaste@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id wBJI5oQT099672; Wed, 19 Dec 2018 18:05:50 GMT (envelope-from emaste@FreeBSD.org) Message-Id: <201812191805.wBJI5oQT099672@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: emaste set sender to emaste@FreeBSD.org using -f From: Ed Maste Date: Wed, 19 Dec 2018 18:05:50 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r342226 - releng/11.2/sys/cddl/contrib/opensolaris/uts/common/fs/zfs X-SVN-Group: releng X-SVN-Commit-Author: emaste X-SVN-Commit-Paths: releng/11.2/sys/cddl/contrib/opensolaris/uts/common/fs/zfs X-SVN-Commit-Revision: 342226 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: BDBC08C8AB X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.96 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-0.97)[-0.966,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US]; NEURAL_HAM_LONG(-1.00)[-0.998,0] X-BeenThere: svn-src-releng@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the release engineering / security commits to the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2018 18:05:51 -0000 Author: emaste Date: Wed Dec 19 18:05:50 2018 New Revision: 342226 URL: https://svnweb.freebsd.org/changeset/base/342226 Log: MFS11 r341828: Resolve a hang in ZFS during vnode reclaimation This is caused by a deadlock between zil_commit() and zfs_zget() Add a way for zfs_zget() to break out of the retry loop in the common case PR: 229614, 231117 Submitted by: allanjude Approved by: so Security: FreeBSD-EN-18:18.zfs Sponsored by: Klara Systems, The FreeBSD Foundation Modified: releng/11.2/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_znode.c Directory Properties: releng/11.2/ (props changed) Modified: releng/11.2/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_znode.c ============================================================================== --- releng/11.2/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_znode.c Wed Dec 19 18:00:58 2018 (r342225) +++ releng/11.2/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_znode.c Wed Dec 19 18:05:50 2018 (r342226) @@ -1155,15 +1155,27 @@ again: */ ASSERT3P(zp, !=, NULL); ASSERT3U(zp->z_id, ==, obj_num); - *zpp = zp; - vp = ZTOV(zp); + if (zp->z_unlinked) { + err = SET_ERROR(ENOENT); + } else { + vp = ZTOV(zp); + /* + * Don't let the vnode disappear after + * ZFS_OBJ_HOLD_EXIT. + */ + VN_HOLD(vp); + *zpp = zp; + err = 0; + } - /* Don't let the vnode disappear after ZFS_OBJ_HOLD_EXIT. */ - VN_HOLD(vp); - sa_buf_rele(db, NULL); ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num); + if (err) { + getnewvnode_drop_reserve(); + return (err); + } + locked = VOP_ISLOCKED(vp); VI_LOCK(vp); if ((vp->v_iflag & VI_DOOMED) != 0 && @@ -1196,7 +1208,7 @@ again: } VI_UNLOCK(vp); getnewvnode_drop_reserve(); - return (0); + return (err); } /* From owner-svn-src-releng@freebsd.org Wed Dec 19 18:21:08 2018 Return-Path: Delivered-To: svn-src-releng@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 13DAB133F5CD; Wed, 19 Dec 2018 18:21:08 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id B023D8D7CC; Wed, 19 Dec 2018 18:21:07 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 9613B19AD2; Wed, 19 Dec 2018 18:21:07 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id wBJIL7YE005584; Wed, 19 Dec 2018 18:21:07 GMT (envelope-from emaste@FreeBSD.org) Received: (from emaste@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id wBJIL77v005583; Wed, 19 Dec 2018 18:21:07 GMT (envelope-from emaste@FreeBSD.org) Message-Id: <201812191821.wBJIL77v005583@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: emaste set sender to emaste@FreeBSD.org using -f From: Ed Maste Date: Wed, 19 Dec 2018 18:21:07 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r342230 - releng/12.0/libexec/bootpd X-SVN-Group: releng X-SVN-Commit-Author: emaste X-SVN-Commit-Paths: releng/12.0/libexec/bootpd X-SVN-Commit-Revision: 342230 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: B023D8D7CC X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.96 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-0.96)[-0.958,0]; NEURAL_HAM_LONG(-1.00)[-0.998,0] X-BeenThere: svn-src-releng@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the release engineering / security commits to the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2018 18:21:08 -0000 Author: emaste Date: Wed Dec 19 18:21:07 2018 New Revision: 342230 URL: https://svnweb.freebsd.org/changeset/base/342230 Log: MFS12 r342228: bootpd: validate hardware type Due to insufficient validation of network-provided data it may have been possible for a malicious actor to craft a bootp packet which could cause a stack buffer overflow. admbugs: 850 Reported by: Reno Robert Reviewed by: markj Approved by: so Security: FreeBSD-SA-18:15.bootpd Sponsored by: The FreeBSD Foundation Modified: releng/12.0/libexec/bootpd/bootpd.c Directory Properties: releng/12.0/ (props changed) Modified: releng/12.0/libexec/bootpd/bootpd.c ============================================================================== --- releng/12.0/libexec/bootpd/bootpd.c Wed Dec 19 18:19:15 2018 (r342229) +++ releng/12.0/libexec/bootpd/bootpd.c Wed Dec 19 18:21:07 2018 (r342230) @@ -636,6 +636,10 @@ handle_request() char *homedir, *bootfile; int n; + if (bp->bp_htype >= hwinfocnt) { + report(LOG_NOTICE, "bad hw addr type %u", bp->bp_htype); + return; + } bp->bp_file[sizeof(bp->bp_file)-1] = '\0'; /* XXX - SLIP init: Set bp_ciaddr = recv_addr here? */ From owner-svn-src-releng@freebsd.org Wed Dec 19 18:22:26 2018 Return-Path: Delivered-To: svn-src-releng@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 13D20133F7C3; Wed, 19 Dec 2018 18:22:26 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id A8BC48DA0F; Wed, 19 Dec 2018 18:22:25 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 99AFE19B31; Wed, 19 Dec 2018 18:22:25 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id wBJIMPGK010210; Wed, 19 Dec 2018 18:22:25 GMT (envelope-from emaste@FreeBSD.org) Received: (from emaste@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id wBJIMP3f010209; Wed, 19 Dec 2018 18:22:25 GMT (envelope-from emaste@FreeBSD.org) Message-Id: <201812191822.wBJIMP3f010209@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: emaste set sender to emaste@FreeBSD.org using -f From: Ed Maste Date: Wed, 19 Dec 2018 18:22:25 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r342231 - releng/11.2/libexec/bootpd X-SVN-Group: releng X-SVN-Commit-Author: emaste X-SVN-Commit-Paths: releng/11.2/libexec/bootpd X-SVN-Commit-Revision: 342231 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: A8BC48DA0F X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.96 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_LONG(-1.00)[-0.998,0]; NEURAL_HAM_SHORT(-0.96)[-0.958,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US] X-BeenThere: svn-src-releng@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the release engineering / security commits to the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2018 18:22:26 -0000 Author: emaste Date: Wed Dec 19 18:22:25 2018 New Revision: 342231 URL: https://svnweb.freebsd.org/changeset/base/342231 Log: MFS11 r342229: bootpd: validate hardware type Due to insufficient validation of network-provided data it may have been possible for a malicious actor to craft a bootp packet which could cause a stack buffer overflow. admbugs: 850 Reported by: Reno Robert Reviewed by: markj Approved by: so Security: FreeBSD-SA-18:15.bootpd Sponsored by: The FreeBSD Foundation Modified: releng/11.2/libexec/bootpd/bootpd.c Directory Properties: releng/11.2/ (props changed) Modified: releng/11.2/libexec/bootpd/bootpd.c ============================================================================== --- releng/11.2/libexec/bootpd/bootpd.c Wed Dec 19 18:21:07 2018 (r342230) +++ releng/11.2/libexec/bootpd/bootpd.c Wed Dec 19 18:22:25 2018 (r342231) @@ -636,6 +636,10 @@ handle_request() char *homedir, *bootfile; int n; + if (bp->bp_htype >= hwinfocnt) { + report(LOG_NOTICE, "bad hw addr type %u", bp->bp_htype); + return; + } bp->bp_file[sizeof(bp->bp_file)-1] = '\0'; /* XXX - SLIP init: Set bp_ciaddr = recv_addr here? */ From owner-svn-src-releng@freebsd.org Wed Dec 19 18:29:47 2018 Return-Path: Delivered-To: svn-src-releng@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 826BA133FAB7; Wed, 19 Dec 2018 18:29:47 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 292398DD7C; Wed, 19 Dec 2018 18:29:47 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 189B019B3F; Wed, 19 Dec 2018 18:29:47 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id wBJITkUh010632; Wed, 19 Dec 2018 18:29:46 GMT (envelope-from emaste@FreeBSD.org) Received: (from emaste@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id wBJITkNf010630; Wed, 19 Dec 2018 18:29:46 GMT (envelope-from emaste@FreeBSD.org) Message-Id: <201812191829.wBJITkNf010630@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: emaste set sender to emaste@FreeBSD.org using -f From: Ed Maste Date: Wed, 19 Dec 2018 18:29:46 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r342232 - in releng/11.2: . sys/conf X-SVN-Group: releng X-SVN-Commit-Author: emaste X-SVN-Commit-Paths: in releng/11.2: . sys/conf X-SVN-Commit-Revision: 342232 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 292398DD7C X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.96 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-0.96)[-0.958,0]; NEURAL_HAM_LONG(-1.00)[-0.998,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US] X-BeenThere: svn-src-releng@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the release engineering / security commits to the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2018 18:29:47 -0000 Author: emaste Date: Wed Dec 19 18:29:46 2018 New Revision: 342232 URL: https://svnweb.freebsd.org/changeset/base/342232 Log: 11.2-RELEASE-p7 UPDATING Approved by: so Security: FreeBSD-SA-18:15.bootpd Security: FreeBSD-EN-18:16.ptrace Security: FreeBSD-EN-18:17.vm Security: FreeBSD-EN-18:18.zfs Modified: releng/11.2/UPDATING releng/11.2/sys/conf/newvers.sh Modified: releng/11.2/UPDATING ============================================================================== --- releng/11.2/UPDATING Wed Dec 19 18:22:25 2018 (r342231) +++ releng/11.2/UPDATING Wed Dec 19 18:29:46 2018 (r342232) @@ -16,6 +16,20 @@ from older versions of FreeBSD, try WITHOUT_CLANG and the tip of head, and then rebuild without this option. The bootstrap process from older version of current across the gcc/clang cutover is a bit fragile. +20181219 p7 FreeBSD-SA-18:15.bootpd + FreeBSD-EN-18:16.ptrace + FreeBSD-EN-18:17.vm + FreeBSD-EN-18:18.zfs + + bootpd: validate hardware type [SA-18:15.bootpd] + + Only clear a pending thread event if one is pending. [EN-18:16.ptrace] + + Update the free page count when blacklisting pages. [EN-18:17.vm] + + Resolve a hang in ZFS during vnode reclamation [EN-18:18.zfs] + + 20181204 p6 FreeBSD-SA-18:14.bhyve Fix insufficient bounds checking in bhyve(8) device model. Modified: releng/11.2/sys/conf/newvers.sh ============================================================================== --- releng/11.2/sys/conf/newvers.sh Wed Dec 19 18:22:25 2018 (r342231) +++ releng/11.2/sys/conf/newvers.sh Wed Dec 19 18:29:46 2018 (r342232) @@ -44,7 +44,7 @@ TYPE="FreeBSD" REVISION="11.2" -BRANCH="RELEASE-p6" +BRANCH="RELEASE-p7" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi From owner-svn-src-releng@freebsd.org Wed Dec 19 18:32:33 2018 Return-Path: Delivered-To: svn-src-releng@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id DD7C8133FCD6; Wed, 19 Dec 2018 18:32:33 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 819CC8E176; Wed, 19 Dec 2018 18:32:33 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 6EFA819CDC; Wed, 19 Dec 2018 18:32:33 +0000 (UTC) (envelope-from emaste@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id wBJIWXB2015705; Wed, 19 Dec 2018 18:32:33 GMT (envelope-from emaste@FreeBSD.org) Received: (from emaste@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id wBJIWXr9015703; Wed, 19 Dec 2018 18:32:33 GMT (envelope-from emaste@FreeBSD.org) Message-Id: <201812191832.wBJIWXr9015703@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: emaste set sender to emaste@FreeBSD.org using -f From: Ed Maste Date: Wed, 19 Dec 2018 18:32:33 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r342233 - in releng/12.0: . sys/conf X-SVN-Group: releng X-SVN-Commit-Author: emaste X-SVN-Commit-Paths: in releng/12.0: . sys/conf X-SVN-Commit-Revision: 342233 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 819CC8E176 X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.96 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-0.96)[-0.958,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US]; NEURAL_HAM_LONG(-1.00)[-0.998,0] X-BeenThere: svn-src-releng@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the release engineering / security commits to the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2018 18:32:34 -0000 Author: emaste Date: Wed Dec 19 18:32:32 2018 New Revision: 342233 URL: https://svnweb.freebsd.org/changeset/base/342233 Log: 12.0-RELEASE-p1 UPDATING Approved by: so Security: FreeBSD-SA-18:15.bootpd Modified: releng/12.0/UPDATING releng/12.0/sys/conf/newvers.sh Modified: releng/12.0/UPDATING ============================================================================== --- releng/12.0/UPDATING Wed Dec 19 18:29:46 2018 (r342232) +++ releng/12.0/UPDATING Wed Dec 19 18:32:32 2018 (r342233) @@ -16,6 +16,10 @@ from older versions of FreeBSD, try WITHOUT_CLANG and the tip of head, and then rebuild without this option. The bootstrap process from older version of current across the gcc/clang cutover is a bit fragile. +20181219: p1 FreeBSD-SA-18:15.bootpd + + bootpd: validate hardware type [SA-18:15.bootpd] + 20181211: 12.0-RELEASE. Modified: releng/12.0/sys/conf/newvers.sh ============================================================================== --- releng/12.0/sys/conf/newvers.sh Wed Dec 19 18:29:46 2018 (r342232) +++ releng/12.0/sys/conf/newvers.sh Wed Dec 19 18:32:32 2018 (r342233) @@ -46,7 +46,7 @@ TYPE="FreeBSD" REVISION="12.0" -BRANCH="RELEASE" +BRANCH="RELEASE-p1" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi