From nobody Mon Jan 16 16:37:18 2023 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Nwd3L5jFHz2snfc; Mon, 16 Jan 2023 16:37:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Nwd3L31mLz3H4t; Mon, 16 Jan 2023 16:37:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1673887038; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/pEQUNR3tL+ZhFk2sTAH9lC8R6/n3t79H/usfSmUL20=; b=f7ErGNMSip8I7bDI8tTNRnVn3PkrCDfUo60CoR1ffv99HF5x1ua/6IaYUH4ay9b1GDwE4A fZ5utYnny8X4hHS04k/3LAu1bKqEE9/Q6yIQjjybpTa1spT64x9kN6iBzTT9f8vNqCAG+9 W3k3bid9hj7v+WTz5pikPyjMGxJxvv/HUaSyS0eleLN39ndk+N5MuXaDlSMJbs/9dPr84U KJT6o7CAjA/9HZ5JPV8zrjsmvJgbpBDon9QjFyuEtl8wPwKhy29E/DhOfIOmzfEFXVu34/ XAhO55ROiRuYxDxaivalN8yKTeat+r2GSmUNVda9B/teIIL9yXnwWgPzR67/6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1673887038; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/pEQUNR3tL+ZhFk2sTAH9lC8R6/n3t79H/usfSmUL20=; b=C2/zGSpfaKJBJytj6KrjhQpBDZOe3hh2nc2d+ba3BRKYAXmrI0SwFrk+xZo3ZQ8lAwxNbl t1iw3+t7VVG8qLRxut32ka9nRqiprqVCBIeo7K4UAcfCi8RO3cNvtwCmZSYR+jeGziUOs5 PtyITsomXL2Jv4ulTUB5OlrL1cNdyZVumOUlN0rxckzrwNVouajoGT4s+JGK0Xqas0giPn KYhSk4RkT5Np/32eJg4HnihkhjL5r5IoXPBja06yvEm2+e6/XCyV6d4FqUjSIc4EcLDsJk mOggEivYgN+6+jiRJz/YN7RVEmD0FPJRCoZR4U2mlMLH1MdHoSqGKL8lNLdIhw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1673887038; a=rsa-sha256; cv=none; b=dblTTjCkIh/F3pr15gMK1Qdn1xG6hFSMiHDH8POsVNMKg/AklaveovlyqF0zZQ48112nZj q00qItif++ugaFriTZC2Ykj0AmeiI42jqKGMHwwrYzjNXmkyHpoOxirgpzhel8l2HdyErK eepUjmSuI3hMXjzxzpZN784akIbs+/ExmuzrLgh+DorUtt7mbYILmWr1bkwmhdf636ztYz QVmEAT4bCUP7ORgeNr48irMG+lrgAFA9+8hycBQR1kHQL9/OuUE+p6ia53GEd0fBSoqc7j 9U6UjcCGfFXU2vBDUsdectA722ZxAkk7OaDgJ1qB7ATU/qlRKYlAjy75WMbO8w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Nwd3L1wS3z1CSw; Mon, 16 Jan 2023 16:37:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 30GGbIP8021347; Mon, 16 Jan 2023 16:37:18 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 30GGbIXQ021345; Mon, 16 Jan 2023 16:37:18 GMT (envelope-from git) Date: Mon, 16 Jan 2023 16:37:18 GMT Message-Id: <202301161637.30GGbIXQ021345@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 8a9495517b0a - main - ipsec: Clear pad bytes in PF_KEY messages List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8a9495517b0ad54da9759a7ba2cc0b56f8e7c8f9 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8a9495517b0ad54da9759a7ba2cc0b56f8e7c8f9 commit 8a9495517b0ad54da9759a7ba2cc0b56f8e7c8f9 Author: Mark Johnston AuthorDate: 2023-01-16 15:46:20 +0000 Commit: Mark Johnston CommitDate: 2023-01-16 16:27:54 +0000 ipsec: Clear pad bytes in PF_KEY messages Various handlers for SADB messages will allocate a new mbuf and populate some structures in it. Some of these structures, such as struct sadb_supported, contain small reserved fields that are not initialized and are thus leaked to userspace. Fix the problem by adding a helper to allocate zeroed mbufs. This reduces code duplication and the overhead of zeroing these messages isn't harmful. Reviewed by: zlei, melifaro Reported by: KMSAN Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D38068 --- sys/netipsec/key.c | 69 +++++++++++++++++++++++------------------------------- 1 file changed, 29 insertions(+), 40 deletions(-) diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c index 98bd97f465bf..345c302c2a80 100644 --- a/sys/netipsec/key.c +++ b/sys/netipsec/key.c @@ -818,6 +818,25 @@ key_havesp_any(void) return (V_spd_size != 0); } +/* + * Allocate a single mbuf with a buffer of the desired length. The buffer is + * pre-zeroed to help ensure that uninitialized pad bytes are not leaked. + */ +static struct mbuf * +key_mget(u_int len) +{ + struct mbuf *m; + + KASSERT(len <= MCLBYTES, + ("%s: invalid buffer length %u", __func__, len)); + + m = m_get2(len, M_NOWAIT, MT_DATA, M_PKTHDR); + if (m == NULL) + return (NULL); + memset(mtod(m, void *), 0, len); + return (m); +} + /* %%% IPsec policy management */ /* * Return current SPDB generation. @@ -2353,14 +2372,8 @@ key_spddelete2(struct socket *so, struct mbuf *m, /* create new sadb_msg to reply. */ len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); - MGETHDR(n, M_NOWAIT, MT_DATA); - if (n && len > MHLEN) { - if (!(MCLGET(n, M_NOWAIT))) { - m_freem(n); - n = NULL; - } - } - if (!n) + n = key_mget(len); + if (n == NULL) return key_senderror(so, m, ENOBUFS); n->m_len = len; @@ -3792,14 +3805,8 @@ key_setsadbmsg(u_int8_t type, u_int16_t tlen, u_int8_t satype, u_int32_t seq, len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); if (len > MCLBYTES) return NULL; - MGETHDR(m, M_NOWAIT, MT_DATA); - if (m && len > MHLEN) { - if (!(MCLGET(m, M_NOWAIT))) { - m_freem(m); - m = NULL; - } - } - if (!m) + m = key_mget(len); + if (m == NULL) return NULL; m->m_pkthdr.len = m->m_len = len; m->m_next = NULL; @@ -4979,14 +4986,8 @@ key_getspi(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) len = PFKEY_ALIGN8(sizeof(struct sadb_msg)) + PFKEY_ALIGN8(sizeof(struct sadb_sa)); - MGETHDR(n, M_NOWAIT, MT_DATA); - if (len > MHLEN) { - if (!(MCLGET(n, M_NOWAIT))) { - m_freem(n); - n = NULL; - } - } - if (!n) { + n = key_mget(len); + if (n == NULL) { error = ENOBUFS; goto fail; } @@ -7201,14 +7202,8 @@ key_register(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) if (len > MCLBYTES) return key_senderror(so, m, ENOBUFS); - MGETHDR(n, M_NOWAIT, MT_DATA); - if (n != NULL && len > MHLEN) { - if (!(MCLGET(n, M_NOWAIT))) { - m_freem(n); - n = NULL; - } - } - if (!n) + n = key_mget(len); + if (n == NULL) return key_senderror(so, m, ENOBUFS); n->m_pkthdr.len = n->m_len = len; @@ -7839,14 +7834,8 @@ key_parse(struct mbuf *m, struct socket *so) if (m->m_next) { struct mbuf *n; - MGETHDR(n, M_NOWAIT, MT_DATA); - if (n && m->m_pkthdr.len > MHLEN) { - if (!(MCLGET(n, M_NOWAIT))) { - m_free(n); - n = NULL; - } - } - if (!n) { + n = key_mget(m->m_pkthdr.len); + if (n == NULL) { m_freem(m); return ENOBUFS; }