From nobody Mon Jul 27 19:14:56 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h87Zn2LSsz6nQGK for ; Mon, 27 Jul 2026 19:14:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h87Zm74vXz3fMZ for ; Mon, 27 Jul 2026 19:14:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785179697; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GJ8pCy5Dk4BtH2YdOlgGDIruttAvA14qYj0pbgyJPUI=; b=dSGLDziTDqWX1M6fx4enFYyoL6NNkDvmYl2mudITDw+lqdAVX3JmpiG/DHwIqLDAKf2bFu /lOlD2SUhFivGYwrqiaOeaFN8kR9WMEusecz8kJxhnnBXIyeMnaeacp80I8c25T5gEp1nz HNR6z9lhELRh6oocrDW+l+n3WaFLC7JnT2lphhglphjoRToC/bG7880cTZYHiiXPpmWP2s gf1lHj8beg562Iwv8zh+YIgL+NnI8kAakC6LSHUWX6FWqGnooyyfkYdj87MyMBpPAisOqB Jy+/cl6TZcgFzIEIIyNrM4fE99/f0HLBLt8OMV+uy9evO9HzcK8HlsGWDQmpmA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785179697; a=rsa-sha256; cv=none; b=N0WRKjBv3Dz7Oq4sx1DJ+UYrabU+Rcn0TIWxhuxZ6RxBVJQJmp/98QjmHkW3f24k8U9zz3 Ko2bE39WZnw3D1DGX6jljxIXJeh17Q31CjJoQZ7TlVxAiSll/xMT6c+M/b2YWveysKAgjr vlIdxHjpaQKPBr2qigj51kjC0/KmMj2eqbz2coqEiSrxgKLN1X3hfIVZFB5mhKmWhVMyTE CxLBTm6KnDfn+9xsy6Qn/YuzIvDVyO3nA9bOv32sFdflaCr2WbTluayB31n+s3WVzMOITJ n/lanJGbNc3RzzmZSgEgEulOUEHdUS5O+31h5+N0uF6vZUV0ysO77jhnZXkCug== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785179697; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GJ8pCy5Dk4BtH2YdOlgGDIruttAvA14qYj0pbgyJPUI=; b=WVmaVk6bFh4pIxA1QpmyhtcoOirhmmOYzNS601G/212wLDmMRy0jSReWOGo6FhfMYOTdVh 2RJdrsyznozg40/ZOo5cKP8eaYW484p4OuSFcPzxn4KJKG5GnJOBVVP35hciETCaEqSwui dzTdxMwVa+RFC7zU3bmi9ljSFvQkIubPD1arbp3yVMextLU/I02JdETzGkeLYocAenQFRM jArW9TN+B878oq6NuDhrug4kYk4z7retxDZW4AYLVOgndzCfNaQdxFImgBParL/s538WRR qr5+FTPVg3cGmE/7LDjjrTxQXBPMy5Dzaw2ibz6Cw6+UKTEfksS6WkUsdM90Hg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h87Zm5xrSz1KSp for ; Mon, 27 Jul 2026 19:14:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 384e5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 27 Jul 2026 19:14:56 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 912c1a2aa8ec - stable/15 - dtrace: Improve DOF section size validation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 912c1a2aa8ec8fe1ea402446d2105bb4c392b59b Auto-Submitted: auto-generated Date: Mon, 27 Jul 2026 19:14:56 +0000 Message-Id: <6a67ae30.384e5.3df038f9@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=912c1a2aa8ec8fe1ea402446d2105bb4c392b59b commit 912c1a2aa8ec8fe1ea402446d2105bb4c392b59b Author: Mark Johnston AuthorDate: 2026-07-06 13:20:33 +0000 Commit: Mark Johnston CommitDate: 2026-07-27 17:34:31 +0000 dtrace: Improve DOF section size validation The loop which validates each DOF section assumes that the section header is present, so the section size must be at least as large as the header, otherwise a small OOB access is possible. Reviewed by: christos MFC after: 2 weeks Sponsored by: CHERI Research Centre Differential Revision: https://reviews.freebsd.org/D57975 (cherry picked from commit c1b6ebc2b7584f93cea4d818468b2aee74475674) --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index 853cfb845878..d4c6c5ec449a 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14201,8 +14201,8 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } - if (dof->dofh_secsize == 0) { - dtrace_dof_error(dof, "zero section header size"); + if (dof->dofh_secsize < sizeof (dof_sec_t)) { + dtrace_dof_error(dof, "invalid section header size"); return (-1); }