From owner-svn-src-head@freebsd.org Mon Jul 18 01:03:41 2016 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 02CAFB9CFC5; Mon, 18 Jul 2016 01:03:41 +0000 (UTC) (envelope-from will@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id AE85B175C; Mon, 18 Jul 2016 01:03:40 +0000 (UTC) (envelope-from will@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u6I13dMX077913; Mon, 18 Jul 2016 01:03:39 GMT (envelope-from will@FreeBSD.org) Received: (from will@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u6I13dPR077910; Mon, 18 Jul 2016 01:03:39 GMT (envelope-from will@FreeBSD.org) Message-Id: <201607180103.u6I13dPR077910@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: will set sender to will@FreeBSD.org using -f From: Will Andrews Date: Mon, 18 Jul 2016 01:03:39 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r302975 - head/lib/libkvm X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jul 2016 01:03:41 -0000 Author: will Date: Mon Jul 18 01:03:39 2016 New Revision: 302975 URL: https://svnweb.freebsd.org/changeset/base/302975 Log: libkvm: Bounds check (more) PTE indices. Modified: head/lib/libkvm/kvm_minidump_arm.c head/lib/libkvm/kvm_minidump_i386.c head/lib/libkvm/kvm_minidump_mips.c Modified: head/lib/libkvm/kvm_minidump_arm.c ============================================================================== --- head/lib/libkvm/kvm_minidump_arm.c Mon Jul 18 01:02:52 2016 (r302974) +++ head/lib/libkvm/kvm_minidump_arm.c Mon Jul 18 01:03:39 2016 (r302975) @@ -184,6 +184,8 @@ _arm_minidump_kvatop(kvm_t *kd, kvaddr_t if (va >= vm->hdr.kernbase) { pteindex = (va - vm->hdr.kernbase) >> ARM_PAGE_SHIFT; + if (pteindex >= vm->hdr.ptesize / sizeof(*ptemap)) + goto invalid; pte = _kvm32toh(kd, ptemap[pteindex]); if ((pte & ARM_L2_TYPE_MASK) == ARM_L2_TYPE_INV) { _kvm_err(kd, kd->program, Modified: head/lib/libkvm/kvm_minidump_i386.c ============================================================================== --- head/lib/libkvm/kvm_minidump_i386.c Mon Jul 18 01:02:52 2016 (r302974) +++ head/lib/libkvm/kvm_minidump_i386.c Mon Jul 18 01:03:39 2016 (r302975) @@ -162,6 +162,8 @@ _i386_minidump_vatop_pae(kvm_t *kd, kvad if (va >= vm->hdr.kernbase) { pteindex = (va - vm->hdr.kernbase) >> I386_PAGE_SHIFT; + if (pteindex >= vm->hdr.ptesize / sizeof(*ptemap)) + goto invalid; pte = le64toh(ptemap[pteindex]); if ((pte & I386_PG_V) == 0) { _kvm_err(kd, kd->program, @@ -207,6 +209,8 @@ _i386_minidump_vatop(kvm_t *kd, kvaddr_t if (va >= vm->hdr.kernbase) { pteindex = (va - vm->hdr.kernbase) >> I386_PAGE_SHIFT; + if (pteindex >= vm->hdr.ptesize / sizeof(*ptemap)) + goto invalid; pte = le32toh(ptemap[pteindex]); if ((pte & I386_PG_V) == 0) { _kvm_err(kd, kd->program, Modified: head/lib/libkvm/kvm_minidump_mips.c ============================================================================== --- head/lib/libkvm/kvm_minidump_mips.c Mon Jul 18 01:02:52 2016 (r302974) +++ head/lib/libkvm/kvm_minidump_mips.c Mon Jul 18 01:03:39 2016 (r302975) @@ -221,9 +221,13 @@ _mips_minidump_kvatop(kvm_t *kd, kvaddr_ if (va >= vm->hdr.kernbase) { pteindex = (va - vm->hdr.kernbase) >> MIPS_PAGE_SHIFT; if (vm->pte_size == 64) { + if (pteindex >= vm->hdr.ptesize / sizeof(*ptemap64)) + goto invalid; pte = _kvm64toh(kd, ptemap64[pteindex]); a = MIPS64_PTE_TO_PA(pte); } else { + if (pteindex >= vm->hdr.ptesize / sizeof(*ptemap32)) + goto invalid; pte = _kvm32toh(kd, ptemap32[pteindex]); a = MIPS32_PTE_TO_PA(pte); }