From nobody Tue Nov 7 14:10:12 2023 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4SPqqT0mR7z50C16; Tue, 7 Nov 2023 14:10:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4SPqqT0F4bz4Xm3; Tue, 7 Nov 2023 14:10:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1699366213; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jXUbZlQl6fCsL37VeiL12o0wqrEBkUQKyggDt3e8nHs=; b=J3UCF/tPBU4WmkKHpHGoSCo2UJetZUSiFIA4zGDmSRTI543aLMYvvFD2OcyZovB+nIPyrd EM2FabqaoEJjfoHgRwiUecZE1nM6k5k5+nwSu+z5w0tcVEoQrOcKxLYW457ukUEUhaVzND be8cKK7x2hw7IMbSGsw50mUoclZw7mo7qXJZATgy4dvZnF+GAMMWSx+/xGO6VMg9LXC/0e itCLG0KcJH3kRQbzc1vFjgg61jLA/FuBg04jYM0fmcYWDq9Lw1c51lHOPq5qo7jyP+1vwi zMCEfbtbpqJ35/BADg4H7ZIupXJUDL99xdwspuFRHc09cpa5C70wN7WVNxzWgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1699366213; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jXUbZlQl6fCsL37VeiL12o0wqrEBkUQKyggDt3e8nHs=; b=dHM71C6uyYXlla9JH05FrMkYgZ8efAzqSqXWTF+wIomFnz9BZ/104IZOEUhgYdBOL5FU1L kmVOnAkJcTHfGHKH+zxwsYr9+o/KY3cPFmN/krOQZv+QMYBkqw6E3mURqL3eH5M35IReAx 7j9VHMRBBxnkusmjQygwYnwiZz0JemU8Y3tOkuOLOhda8NBjXV43p5sc57uxtorHVvk9Xl 7NiGqebF1073Z18cSCKBJwhmPmyNo9P5iVqmtlh3JCGxwGvpP/wa+vPE2wLscBdxUKA1V4 PAIVZD8d9uNqEL+/tY3RSTCiY2LG3IdAJgHInLvK5YUrLCmSOxpX8NN6rHrwbA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1699366213; a=rsa-sha256; cv=none; b=mb2VDTiYE6ZEpidKSpLeGMQXGX1HFzlgkfXsGiOdK2RARnsvSNQ7rWOexX1s69Eh4kypZ+ XnRwwgC76hLK+JgC/ZMgAuf9FQ02dIvr28q00xNT1cC8kKmBi37bKH+ab5BOfZYQ2TIGTk 2l/z8Ls/9yJ7zh2KNQe7jHjO4nduQEfV1TKaPnCywtwhqEI0RE0//WhGD1He0efQ48wThV VlwWLZWpepc7zF6bcqzJEkJ8uN61IbCJk/006K7NkYNfUNZpF7P02fdLwXa4jGtRWAAs09 a7Ohndahm53f6qrDC1rKuscxkcHPQvEV0pf93iQjIqcsDVvfGvdBk61mMRQ09A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4SPqqS6RLVzsvH; Tue, 7 Nov 2023 14:10:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 3A7EACxe008795; Tue, 7 Nov 2023 14:10:12 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 3A7EAC7f008783; Tue, 7 Nov 2023 14:10:12 GMT (envelope-from git) Date: Tue, 7 Nov 2023 14:10:12 GMT Message-Id: <202311071410.3A7EAC7f008783@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: 6cb5690b3495 - stable/13 - fflush: correct buffer handling in __sflush List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 6cb5690b3495741e9ece6f42ba4a85732932aa83 Auto-Submitted: auto-generated The branch stable/13 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=6cb5690b3495741e9ece6f42ba4a85732932aa83 commit 6cb5690b3495741e9ece6f42ba4a85732932aa83 Author: Dag-Erling Smørgrav AuthorDate: 2023-08-03 15:13:45 +0000 Commit: Ed Maste CommitDate: 2023-11-07 13:39:48 +0000 fflush: correct buffer handling in __sflush This fixes CVE-2014-8611 correctly. The commit that purported to fix CVE-2014-8611 (805288c2f062) only hid it behind another bug. Two later commits, 86a16ada1ea6 and 44cf1e5eb470, attempted to address this new bug but mostly just confused the issue. This commit rolls back the three previous changes and fixes CVE-2014-8611 correctly. The key to understanding the bug (and the fix) is that `_w` has different meanings for different stream modes. If the stream is unbuffered, it is always zero. If the stream is fully buffered, it is the amount of space remaining in the buffer (equal to the buffer size when the buffer is empty and zero when the buffer is full). If the stream is line-buffered, it is a negative number reflecting the amount of data in the buffer (zero when the buffer is empty and negative buffer size when the buffer is full). At the heart of `fflush()`, we call the stream's write function in a loop, where `t` represents the return value from the last call and `n` the amount of data that remains to be written. When the write function fails, we need to move the unwritten data to the top of the buffer (unless nothing was written) and adjust `_p` (which points to the next free location in the buffer) and `_w` accordingly. These variables have already been set to the values they should have after a successful flush, so instead of adjusting them down to reflect what was written, we're adjusting them up to reflect what remains. The bug was that while `_p` was always adjusted, we only adjusted `_w` if the stream was fully buffered. The fix is to also adjust `_w` for line-buffered streams. Everything else is just noise. Fixes: 805288c2f062 Fixes: 86a16ada1ea6 Fixes: 44cf1e5eb470 Sponsored by: Klara, Inc. (cherry picked from commit d09a3bf72c0b5f1779c52269671872368c99f02a) (cherry picked from commit 92709431b14df6c0687446247ac57cfc189ee827) Approved by: so --- lib/libc/stdio/fflush.c | 21 +++++++-------------- lib/libc/stdio/fvwrite.c | 4 ++-- lib/libc/stdio/wbuf.c | 2 +- 3 files changed, 10 insertions(+), 17 deletions(-) diff --git a/lib/libc/stdio/fflush.c b/lib/libc/stdio/fflush.c index 7ad6adedf53f..61f23335106f 100644 --- a/lib/libc/stdio/fflush.c +++ b/lib/libc/stdio/fflush.c @@ -103,8 +103,8 @@ __weak_reference(__fflush, fflush_unlocked); int __sflush(FILE *fp) { - unsigned char *p, *old_p; - int n, f, t, old_w; + unsigned char *p; + int n, f, t; f = fp->_flags; if ((f & __SWR) == 0) @@ -119,26 +119,19 @@ __sflush(FILE *fp) * Set these immediately to avoid problems with longjmp and to allow * exchange buffering (via setvbuf) in user write function. */ - old_p = fp->_p; fp->_p = p; - old_w = fp->_w; fp->_w = f & (__SLBF|__SNBF) ? 0 : fp->_bf._size; for (; n > 0; n -= t, p += t) { t = _swrite(fp, (char *)p, n); if (t <= 0) { - /* Reset _p and _w. */ - if (p > fp->_p) { + if (p > fp->_p) /* Some was written. */ memmove(fp->_p, p, n); - fp->_p += n; - if ((fp->_flags & (__SLBF | __SNBF)) == 0) - fp->_w -= n; - /* conditional to handle setvbuf */ - } else if (p == fp->_p && errno == EINTR) { - fp->_p = old_p; - fp->_w = old_w; - } + /* Reset _p and _w. */ + fp->_p += n; + if ((fp->_flags & __SNBF) == 0) + fp->_w -= n; fp->_flags |= __SERR; return (EOF); } diff --git a/lib/libc/stdio/fvwrite.c b/lib/libc/stdio/fvwrite.c index 81e7ba89a644..26245acca1c9 100644 --- a/lib/libc/stdio/fvwrite.c +++ b/lib/libc/stdio/fvwrite.c @@ -139,7 +139,7 @@ __sfvwrite(FILE *fp, struct __suio *uio) fp->_p += w; old_p = fp->_p; if (__fflush(fp) == EOF) { - if (old_p == fp->_p && errno == EINTR) + if (old_p == fp->_p) fp->_p -= w; goto err; } @@ -183,7 +183,7 @@ __sfvwrite(FILE *fp, struct __suio *uio) fp->_p += w; old_p = fp->_p; if (__fflush(fp) == EOF) { - if (old_p == fp->_p && errno == EINTR) + if (old_p == fp->_p) fp->_p -= w; goto err; } diff --git a/lib/libc/stdio/wbuf.c b/lib/libc/stdio/wbuf.c index acbe379ad90e..808cfa588cfb 100644 --- a/lib/libc/stdio/wbuf.c +++ b/lib/libc/stdio/wbuf.c @@ -89,7 +89,7 @@ __swbuf(int c, FILE *fp) old_p = fp->_p; if (++n == fp->_bf._size || (fp->_flags & __SLBF && c == '\n')) { if (__fflush(fp) != 0) { - if (fp->_p == old_p && errno == EINTR) { + if (fp->_p == old_p) { fp->_p--; fp->_w++; }