From nobody Mon Jul 27 19:14:57 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h87Zp3Qdhz6nQMC for ; Mon, 27 Jul 2026 19:14:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h87Zp0r4Cz3fXt for ; Mon, 27 Jul 2026 19:14:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785179698; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Y4TViZ+5m2bBa9EWMXwQh0cbOiYkmBZq2kMusLD3h+Q=; b=XMJlzUDY9cnJnjKtT8/k887lLt5Dk1Bh+mIvcdesvpyKsY1boqC/Y9BhB0yam/1KwVRK7x UiLbKtldKmo9mLGyxoFsBT3hDsAJLIX2RqeETEQxnkXLDXERK7GbHpxH5bdGEHtUOfy79u Be6cVfOtshDm53mrHqGLkWpeEYFAjKVRDenfc0meoTn48k0xr6KCyOBGDu8FEVI7TY6cnM flRUzqnlBnrvADjVxmwNNAtGVCCzQXpcVCyNZJLX7nWbumtX35HF1n843AEj0KmcMOnEt2 i2AiHT1cXqpRYd8M79VIWiE2aaxaWqDoMPc2DmzAs2/kKbhxNtLsnWTJCYCrnQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785179698; a=rsa-sha256; cv=none; b=a1Lk/mZAs2QPyqSFUOzwSKoKjKmuqOVfvSbXcGt6fV59a6nvZw2MhmVYbqdkrRsBt/l/qh u7GB0hkc4YEVS99drn657DV4E8JIcrcx3OfMhfk1R/d5oClLGKBPlGWVKotmkimsOo//Zl 7TwAtrEYsa2ebQ9YMbbzvqY5BNiXtAm5sh4NQkWSDiWw7hxu/WFZOZbeUwce7OSRbiGE1x ycom3+MTig2zBmwlbRcNpJNUE+BqQf2BvNq7h3Duu2I3SeKB4436vUAJJuY7S/ZPwVRdrt 3al5Hh051U6xE+VVNGAMhF8JsyTf65Ps9vkVawdfwu8brMdUibqOwN8l8k9MHA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785179698; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Y4TViZ+5m2bBa9EWMXwQh0cbOiYkmBZq2kMusLD3h+Q=; b=eyORNiwA0i5aTZ90PEtSh8J+eIiQ5/eQQOfpTcFLbQFaJo2ixt2xNUsuUJtkE1NlxAixRe dJd/Q6k70Oxm62lbK9PfTb0j4Ew8Vu/1Q4hi4AGWGNaBbIh+WIf7o53PrlyQ/jA1erzxJ1 mBij7A46494QZMnGyeiC62lHDnbepgLUpmNxykI6VZCWS6+7fYUBWT6JlgVvbSTYqxXvIU 6igEUqJY2hIGa1ob+4h5JDS6CVBfhrK4lE6eQtTCSPu5de5MNt+w9UHwHQk1GRiCY6GvYn VefCNDUS+E+bz1z0fa20YrCKIvxrBaMA+WSMSvoN67FAY2VjLeWdRl3zXNZPkQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h87Zn6whfz1L3L for ; Mon, 27 Jul 2026 19:14:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 36c43 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 27 Jul 2026 19:14:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 0c829bb55a86 - stable/15 - dtrace: Fix DOF section bounds validation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 0c829bb55a86b696e6a6c66da28d856cb5c06772 Auto-Submitted: auto-generated Date: Mon, 27 Jul 2026 19:14:57 +0000 Message-Id: <6a67ae31.36c43.75772c5a@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=0c829bb55a86b696e6a6c66da28d856cb5c06772 commit 0c829bb55a86b696e6a6c66da28d856cb5c06772 Author: Mark Johnston AuthorDate: 2026-07-06 13:21:08 +0000 Commit: Mark Johnston CommitDate: 2026-07-27 17:34:31 +0000 dtrace: Fix DOF section bounds validation We must ensure that each DOF section does not overlap with the DOF header or section table. Otherwise the relocations processed in the second pass over sections can manipulate DOF metadata, leading to OOB writes. Reviewed by: christos MFC after: 2 weeks Sponsored by: CHERI Research Centre Differential Revision: https://reviews.freebsd.org/D57976 (cherry picked from commit 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15) --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index d4c6c5ec449a..aa8716908cb1 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14276,6 +14276,18 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } + if (sec->dofs_offset < sizeof (dof_hdr_t)) { + dtrace_dof_error(dof, "section overlaps header"); + return (-1); + } + + if (sec->dofs_offset + sec->dofs_size > dof->dofh_secoff && + sec->dofs_offset < dof->dofh_secoff + + dof->dofh_secnum * dof->dofh_secsize) { + dtrace_dof_error(dof, "invalid section offset"); + return (-1); + } + if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr + sec->dofs_offset + sec->dofs_size - 1) != '\0') { dtrace_dof_error(dof, "non-terminating string table");