From nobody Mon Jul 6 13:28:28 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gv4tj3V5rz6jYCr for ; Mon, 06 Jul 2026 13:28:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gv4tj0XcLz3rcQ for ; Mon, 06 Jul 2026 13:28:29 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783344509; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xl35qKMtF5OQJGvUjRBjFxKKORH3AvJxpMJ+jF/NLS8=; b=TFvJrnqAR13J7Xv57w7MxiJ6m8osIfJQeALjSs6R6zyDIxCx7uykuv4tUu3UohN50Gsq6N ghPxpDmp6JS6t/Kh0wqtmaIVmcBDn+uKNnW0/GNkYgnZt8lSgiPoFSuApSeZCq2i4s1BBg Gwa+p+11EB7BG274QPql82sr5HkgNV5E4I3/VH1MU92zkY+oGARtkVWXz5E7qztIxTc13C m+XJe4sIPOVbJYa8kps46sHBmbK2BTXm1mZnSEJuoE19iNeI257U1uakzFf173/AvdyOKr YueTfjMzReLZEL3NA7s1Gr0v0Ger4oRIKI3vW1CW23BQhdrEd5la9ub977XhOw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783344509; a=rsa-sha256; cv=none; b=biLihdpMEnLsQaT65tP3NvAWVpdGS6QuCbwZ4ve/WZITgjIxOiNC9ViAkHX4B5thOKxaeZ 5YUlsFv54iKU6rNdo9se147EWikymLQiC97pf9FOQpxDe3ZD2XHRY8G9a+b1smsfphAEx7 igSehhE7CbV/myZpoKJgLAUsO+pPNVO3U/d35bPkUekSH/fzKin6uZfaUpsYWiZt9YwIH+ w55ZD/y/VNQsOIpuzFgUzwhfLdhZJFRD6UA3G7sIWHFsVnrOxwjYqOBZHz5juHxN9yK9b3 cQI/y+84LP34sDQ4uv7ubRus5bc7x1LOtZbWLy2/1tgXp/6ebKLVhMdxedEsdw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783344509; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xl35qKMtF5OQJGvUjRBjFxKKORH3AvJxpMJ+jF/NLS8=; b=V3VR5ymlUnVnHwQXjtKkCCM9Ttfn59BolPchtjzyb8XlrCotRQw3dfVE+KtcHhTaxkv3IY DVw3ZRqFLKn6BtGe/XPcJHLM4h7Q863AqOYPHz3xFpmeJlbjU9VxVflJV8yF2uAhKVn4jW UnY2tMG0UNR6/ppUnBxj0HKJGyBlRxE7pi1luTsFzddMBcCNAvZJc43JLViGoECFrHnyKX KvRR46R16hUkrO+r3uXRWwObhACE9V4cMKyJh2sRZP60+jY7TyB2RPLyZqktCVfp7UR0hf fH4gwRKC5tS0b1W007VgSGnctXtyNr6RggnyjzETkPRmHRYdkc4VcduLcpyVmw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gv4th5wRxz15fF for ; Mon, 06 Jul 2026 13:28:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 40ddb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 06 Jul 2026 13:28:28 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 8dc98f4d25a3 - main - dtrace: Fix DOF section bounds validation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15 Auto-Submitted: auto-generated Date: Mon, 06 Jul 2026 13:28:28 +0000 Message-Id: <6a4bad7c.40ddb.609eb75b@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15 commit 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15 Author: Mark Johnston AuthorDate: 2026-07-06 13:21:08 +0000 Commit: Mark Johnston CommitDate: 2026-07-06 13:21:08 +0000 dtrace: Fix DOF section bounds validation We must ensure that each DOF section does not overlap with the DOF header or section table. Otherwise the relocations processed in the second pass over sections can manipulate DOF metadata, leading to OOB writes. Reviewed by: christos MFC after: 2 weeks Sponsored by: CHERI Research Centre Differential Revision: https://reviews.freebsd.org/D57976 --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index d4c6c5ec449a..aa8716908cb1 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14276,6 +14276,18 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } + if (sec->dofs_offset < sizeof (dof_hdr_t)) { + dtrace_dof_error(dof, "section overlaps header"); + return (-1); + } + + if (sec->dofs_offset + sec->dofs_size > dof->dofh_secoff && + sec->dofs_offset < dof->dofh_secoff + + dof->dofh_secnum * dof->dofh_secsize) { + dtrace_dof_error(dof, "invalid section offset"); + return (-1); + } + if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr + sec->dofs_offset + sec->dofs_size - 1) != '\0') { dtrace_dof_error(dof, "non-terminating string table");