From nobody Mon Jul 27 22:32:38 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h8Cyt4Qp4z6lxm6 for ; Mon, 27 Jul 2026 22:32:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h8Cyt2L7Fz3CJh for ; Mon, 27 Jul 2026 22:32:38 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785191558; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fPEv9IFU/sPx94fCQ5XAq1rZKXoq/ncHRgwujXswq58=; b=EtcTQMdoBYJa5LFXQuzPpWku4X01J/vbKDta5M6BAkm4uoY1LYCdqPPrs7543lXvFl8FXR AdKMFlP7IjIrI8xkl9PWdkKl4MTqWmhDgEKKYyFpB8MH2XuMLbwOJk50XPTYyKabdACAAu Ck7Xdyl08N2NDr3JdRpESz3pLzy6UyV5mZoGR5CHF7Vj7tLkhJTQo/wyT9tZDSCzos24KL 3OtoGgNBwKuCXPGPGfwxNW21tF30LK3oHguN50GSEtgLTggFKlJG6ScR4sQ+AKJvbzaIJA TSpb/47wfzBvQr7U5+O/7EqrESgxOoerVo6paxTUbYB1rw0giNlyXyTNJemxHA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785191558; a=rsa-sha256; cv=none; b=U3embNWiRJ4pt8eLqbC/FCh78o7M663ksbPSBWvr+0dIs/S8IUIul7HhUhWt0z2x9bBaP4 AXVAIF1bxaYjQQUQKy9X1jZqenvzeA4sQn6bwxk1I/HH5IO2NbmSvAvU7PUNzYOYG53wFo qWKc5xzpquUp8urv1Y9a/iurUg9NBJ2OJI5Y/koO4sfgmS7tcwSnRl3DdJxqpOquF8DZ34 inh0hOapQz2IIOKeCsNC6RnHu6oHYdssRlFwbCjvyclkOMyLJeh0MT3dFBmdxl2FlPsgA5 ALp0jJLW7mkq+PzWRhEsGpRLxn2TC22HayvJGwKkxrqfdDXZ3v0EwO2rWENCcg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785191558; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fPEv9IFU/sPx94fCQ5XAq1rZKXoq/ncHRgwujXswq58=; b=LsYuaWhjsr7lG4rJAFvvCxxZaZ8LvTe3v+G+75I7LvWncm9BrOS1P1u7ueXYu0by6rjyiv YaBBi86tcHbTi+N00eqirnqCfPa2K8Pm7d/nntzi6dM+PZw2H8JcmvXBwp232oqnfr84WY 20D7YxOtnZFtOVrCnP/V1pNRJ9ZvRxKsmC43JmecvbcNXPogmYA6BdrULxS2XI5cpENPID rW62yAEhDhibmuK9x/PQhv+/AgviuO3iyh/Bm3y/zXPwaxoQryHooSjvzyt7ifFncFWJ72 M0FzOKdJ0YD4tK8fxOxwkwwlx+qEdYqqPc+ofK18npWZakfwuKAHrPacXKIOAg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h8Cyt196Kz1Qkm for ; Mon, 27 Jul 2026 22:32:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 25d47 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 27 Jul 2026 22:32:38 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: a8954ff89caa - stable/14 - dtrace: Fix DOF section bounds validation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: a8954ff89caa6be06361959cdcbc561d615e0e73 Auto-Submitted: auto-generated Date: Mon, 27 Jul 2026 22:32:38 +0000 Message-Id: <6a67dc86.25d47.607c7f2@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=a8954ff89caa6be06361959cdcbc561d615e0e73 commit a8954ff89caa6be06361959cdcbc561d615e0e73 Author: Mark Johnston AuthorDate: 2026-07-06 13:21:08 +0000 Commit: Mark Johnston CommitDate: 2026-07-27 14:05:07 +0000 dtrace: Fix DOF section bounds validation We must ensure that each DOF section does not overlap with the DOF header or section table. Otherwise the relocations processed in the second pass over sections can manipulate DOF metadata, leading to OOB writes. Reviewed by: christos MFC after: 2 weeks Sponsored by: CHERI Research Centre Differential Revision: https://reviews.freebsd.org/D57976 (cherry picked from commit 8dc98f4d25a31a8dfddbcc18eb0ee2e0f005ec15) --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index d4c6c5ec449a..aa8716908cb1 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -14276,6 +14276,18 @@ dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, return (-1); } + if (sec->dofs_offset < sizeof (dof_hdr_t)) { + dtrace_dof_error(dof, "section overlaps header"); + return (-1); + } + + if (sec->dofs_offset + sec->dofs_size > dof->dofh_secoff && + sec->dofs_offset < dof->dofh_secoff + + dof->dofh_secnum * dof->dofh_secsize) { + dtrace_dof_error(dof, "invalid section offset"); + return (-1); + } + if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr + sec->dofs_offset + sec->dofs_size - 1) != '\0') { dtrace_dof_error(dof, "non-terminating string table");