From nobody Mon Dec 8 13:31:16 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dQ2tr5FZxz6JnhV for ; Mon, 08 Dec 2025 13:31:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dQ2tr2D80z3fZn for ; Mon, 08 Dec 2025 13:31:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765200676; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BXOf/WuzbB0+2G3/+oGyQOk5D7IlqR1XSR+bIB6xLAg=; b=DiawlhNMXXpfejybrLXEayxIVojoGlCwkP/rA8jMmQzXAIFkALuTMHYak4SwH5CKIcPFdx mJHiXmnfPma2rHgN51RDPcwVUSSHdvwcmJDj6UuiUhSlzc6HMIsmyDIsmULkJLpE2jHMJL iw5S/yvXoWnwsXjHHdq1xtKh8EJ96zc+LVKhlpslNxHP/LBkE+NrRCe77A8m6TfrxBDbRM 1PMsCCXgVqAgR0Fl1Le8mN9KrCxMJFR0lobOnsZehHGYe0c7nndwfPFRrW0C1A+YVyQxeP FjyHsFzovrcTLgyPv0qWThXocG/UQoOnjxJ1H5G820dY8k+k7HN/fGMviomqDQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765200676; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BXOf/WuzbB0+2G3/+oGyQOk5D7IlqR1XSR+bIB6xLAg=; b=nGJMfyQpiwc30DnK7hWnqBRCzWx5opwCJs8bCjNdy3cg2eIv0NdAO/cqz6nnxWcYxDIyrP c575Z4xKoDxPoYHyl2EHWH6dkfpaRj3qsdF4koB/g+j0E7lA5CgmEpJEsy1UdglxOxEt6X BNdSFQfBDZk6fNcLDHPkMXHcxMNMf189wV59/u3N2V9mQyt7CzSv2kzpdGNKQXyNaN06Ca eQS/Dy8MyxTK4KBJ2jFIWje6Se4DU0l6g2zKVVc0Lcfheob9fUjdvsKIRkEjqV0poF9KMT 4+4w1AspP1dkQspqyvOtZP6XOATEfd4Si7zP4HUXS23H9NT9SgPKqDwBtbAmag== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765200676; a=rsa-sha256; cv=none; b=W1kFbqigjkvsl/Ah1bg6WcYVEiRLM/itGWoyTga8xjPuY2BMyZYG6ATezKJvD84MZzuoAa HORO9Ey595L7WOJnL7ejcxxram6VgW5XEfgZHNa+DZm6icqWNnI5UJm33GABsYtkuymc9B Co+LDIwishehjIdr5PYOrvEGq9fVRUoGqOgb6948CzhZBHodLmLRMoBkP5N2WHTgTJPoCq jNFPjuT9rvo7ImxNsV09gCHdbnf0nQyCMdEOUtTTEPM8lKXnFPEm87Qte32EXuHht2gspz r9C3wij8NG5LIPrYvXzWEkxPGz5yX0rPChUutxGaJTTWKOa1ixJNVdeWDFDrbQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dQ2tr1TDYzN5 for ; Mon, 08 Dec 2025 13:31:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 29c67 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 08 Dec 2025 13:31:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jessica Clarke Subject: git: 5d58198ccc2b - main - imgact_elf: Fix off-by-one in note size check List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jrtc27 X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 5d58198ccc2b562098ee5fc4898013622b32b065 Auto-Submitted: auto-generated Date: Mon, 08 Dec 2025 13:31:16 +0000 Message-Id: <6936d324.29c67.5b218d5b@gitrepo.freebsd.org> The branch main has been updated by jrtc27: URL: https://cgit.FreeBSD.org/src/commit/?id=5d58198ccc2b562098ee5fc4898013622b32b065 commit 5d58198ccc2b562098ee5fc4898013622b32b065 Author: Jessica Clarke AuthorDate: 2025-12-08 13:01:57 +0000 Commit: Jessica Clarke CommitDate: 2025-12-08 13:01:57 +0000 imgact_elf: Fix off-by-one in note size check Prior to c86af2cc4cd1 ("imgact_elf: Check note body sizes"), this was note_name + n_namesz >= note_end, which checks that there is at least one byte after the unpadded name (which could be either padding or data), and given our notes always have data with them this was fine. However, once we started checking the padded name (note that "FreeBSD\0" is already a multiple of 4 bytes, so has no padding) and data, this turned into checking that there is at least one byte after the unpadded data, and since our ELF notes already have a multiple of 4 bytes for their data and therefore have no padding, this means that we are now checking that there is at least one byte after the ELF note, which is not going to be the case for the last ELF note. Instead, switch this to a strict greater than, as should be used when comparing one-past-the-end pointers, which both sides of the inequality are. For executables, this was generally not a problem in reality, since the last of our ELF notes is NT_FREEBSD_NOINIT_TAG, which isn't read by the kernel. However, ld-elf.so.1 (and libcompat variants), like shared libraries, only has NT_FREEBSD_ABI_TAG, which meant the kernel did not see this ELF note when directly executing it (e.g. as done by ldd), and on RISC-V this is the only branding present, so doing so would fail with ENOEXEC. This does also mean on non-RISC-V direct exec ld-elf.so.1 runs with the wrong p_osrel, but given it sets kern.proc.osrel.PID to the executable's NT_FREEBSD_ABI_TAG that it loads, this probably doesn't matter in practice. PR: 291446 Reported by: bdragon Tested by: bdragon Fixes: c86af2cc4cd1 ("imgact_elf: Check note body sizes") MFC after: 3 days --- sys/kern/imgact_elf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c index 779158b41221..f1d848e95f18 100644 --- a/sys/kern/imgact_elf.c +++ b/sys/kern/imgact_elf.c @@ -2840,7 +2840,7 @@ __elfN(parse_notes)(const struct image_params *imgp, const Elf_Note *checknote, goto nextnote; note_name = (const char *)(note + 1); if (note_name + roundup2(note->n_namesz, ELF_NOTE_ROUNDSIZE) + - note->n_descsz >= (const char *)note_end || + note->n_descsz > (const char *)note_end || strncmp(note_vendor, note_name, checknote->n_namesz) != 0) goto nextnote;