From owner-svn-src-releng@freebsd.org  Tue May 17 23:07:14 2016
Return-Path: <owner-svn-src-releng@freebsd.org>
Delivered-To: svn-src-releng@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id E6DFBB40BF7;
 Tue, 17 May 2016 23:07:14 +0000 (UTC)
 (envelope-from glebius@FreeBSD.org)
Received: from cell.glebi.us (glebi.us [96.95.210.25])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "cell.glebi.us", Issuer "cell.glebi.us" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id BBA1217F7;
 Tue, 17 May 2016 23:07:11 +0000 (UTC)
 (envelope-from glebius@FreeBSD.org)
Received: from cell.glebi.us (localhost [127.0.0.1])
 by cell.glebi.us (8.15.2/8.15.2) with ESMTPS id u4HN7AeJ038710
 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO);
 Tue, 17 May 2016 16:07:10 -0700 (PDT)
 (envelope-from glebius@FreeBSD.org)
Received: (from glebius@localhost)
 by cell.glebi.us (8.15.2/8.15.2/Submit) id u4HN7AH1038709;
 Tue, 17 May 2016 16:07:10 -0700 (PDT)
 (envelope-from glebius@FreeBSD.org)
X-Authentication-Warning: cell.glebi.us: glebius set sender to
 glebius@FreeBSD.org using -f
Date: Tue, 17 May 2016 16:07:10 -0700
From: Gleb Smirnoff <glebius@FreeBSD.org>
To: Bryan Drewery <bdrewery@FreeBSD.org>
Cc: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-releng@freebsd.org
Subject: Re: svn commit: r300088 - in releng/9.3: . sys/conf sys/dev/kbd
Message-ID: <20160517230710.GB1015@FreeBSD.org>
References: <201605172228.u4HMSbhj012124@repo.freebsd.org>
 <14a8d29d-bc14-3f96-57a4-81f1b6dfdd82@FreeBSD.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <14a8d29d-bc14-3f96-57a4-81f1b6dfdd82@FreeBSD.org>
User-Agent: Mutt/1.6.1 (2016-04-27)
X-BeenThere: svn-src-releng@freebsd.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: SVN commit messages for the release engineering / security commits to
 the src tree <svn-src-releng.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-releng>, 
 <mailto:svn-src-releng-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-releng/>
List-Post: <mailto:svn-src-releng@freebsd.org>
List-Help: <mailto:svn-src-releng-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-releng>,
 <mailto:svn-src-releng-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 17 May 2016 23:07:15 -0000

On Tue, May 17, 2016 at 03:59:26PM -0700, Bryan Drewery wrote:
B> > Author: glebius
B> > Date: Tue May 17 22:28:36 2016
B> > New Revision: 300088
B> > URL: https://svnweb.freebsd.org/changeset/base/300088
B> > 
B> > Log:
B> >   - Use unsigned version of min() when handling arguments of SETFKEY ioctl.
B> >   - Validate that user supplied control message length in sendmsg(2)
B> >     is not negative.
B> 
B> The sendmsg(2) change is not included here (9.3) nor in the advisory but
B> is in the commit log.  Was it intended to be changed in 9.3?

That was my failure to mention SA-16:19 in commit message for 9.3. It doesn't
apply to 9.x.

B> Plus the only consumer I see is sendit() which seems to be protected
B> already from negative values when not using COMPAT_43:
B> 
B> >                  if (mp->msg_controllen < sizeof(struct cmsghdr)
B> >  #ifdef COMPAT_OLDSOCK
B> >                      && mp->msg_flags != MSG_COMPAT
B> >  #endif
B> >                  ) {
B> >                          error = EINVAL;
B> >                          goto bad;
B> >                  }
B> >                  error = sockargs(&control, mp->msg_control,
B> >                      mp->msg_controllen, MT_CONTROL);

No, it isn't protected. In the comparison (mp->msg_controllen < sizeof(struct cmsghdr))
both values are unsigned. Later in sockargs() it is treated as signed.

-- 
Totus tuus, Glebius.