From owner-svn-src-head@freebsd.org Tue Dec 17 21:34:38 2019 Return-Path: Delivered-To: svn-src-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id B84381CAC2A; Tue, 17 Dec 2019 21:34:38 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 47cry64Krlz3KK6; Tue, 17 Dec 2019 21:34:38 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 8FD441C18A; Tue, 17 Dec 2019 21:34:38 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id xBHLYcvf049061; Tue, 17 Dec 2019 21:34:38 GMT (envelope-from markj@FreeBSD.org) Received: (from markj@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id xBHLYc0A049060; Tue, 17 Dec 2019 21:34:38 GMT (envelope-from markj@FreeBSD.org) Message-Id: <201912172134.xBHLYc0A049060@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: markj set sender to markj@FreeBSD.org using -f From: Mark Johnston Date: Tue, 17 Dec 2019 21:34:38 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r355864 - head/sys/dev/an X-SVN-Group: head X-SVN-Commit-Author: markj X-SVN-Commit-Paths: head/sys/dev/an X-SVN-Commit-Revision: 355864 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Dec 2019 21:34:38 -0000 Author: markj Date: Tue Dec 17 21:34:38 2019 New Revision: 355864 URL: https://svnweb.freebsd.org/changeset/base/355864 Log: an(4): Require privileges for all SIOCGAIRONET requests. SIOCGAIRONET allows userspace to query an(4) for various device properties and configuration, which appears to potentially include sensitive information such as WEP keys (an(4) seems to predate WPA). Also avoid races by copying in the request structure to a temporary buffer before locking and modifying the device softc. Reported by: Ilja Van Sprundel MFC after: 3 days Sponsored by: The FreeBSD Foundation Modified: head/sys/dev/an/if_an.c Modified: head/sys/dev/an/if_an.c ============================================================================== --- head/sys/dev/an/if_an.c Tue Dec 17 20:30:32 2019 (r355863) +++ head/sys/dev/an/if_an.c Tue Dec 17 21:34:38 2019 (r355864) @@ -1875,6 +1875,7 @@ an_ioctl(struct ifnet *ifp, u_long command, caddr_t da int len; int i, max; struct an_softc *sc; + struct an_req *areq; struct ifreq *ifr; struct thread *td = curthread; struct ieee80211req *ireq; @@ -1934,17 +1935,21 @@ an_ioctl(struct ifnet *ifp, u_long command, caddr_t da error = 0; break; case SIOCGAIRONET: - error = copyin(ifr_data_get_ptr(ifr), &sc->areq, - sizeof(sc->areq)); - if (error != 0) + error = priv_check(td, PRIV_DRIVER); + if (error) break; + areq = malloc(sizeof(*areq), M_TEMP, M_WAITOK); + error = copyin(ifr_data_get_ptr(ifr), areq, sizeof(*areq)); + if (error != 0) { + free(areq, M_TEMP); + break; + } AN_LOCK(sc); + memcpy(&sc->areq, areq, sizeof(sc->areq)); #ifdef ANCACHE if (sc->areq.an_type == AN_RID_ZERO_CACHE) { - error = priv_check(td, PRIV_DRIVER); - if (error) - break; sc->an_sigitems = sc->an_nextitem = 0; + free(areq, M_TEMP); break; } else if (sc->areq.an_type == AN_RID_READ_CACHE) { char *pt = (char *)&sc->areq.an_val; @@ -1960,12 +1965,14 @@ an_ioctl(struct ifnet *ifp, u_long command, caddr_t da #endif if (an_read_record(sc, (struct an_ltv_gen *)&sc->areq)) { AN_UNLOCK(sc); + free(areq, M_TEMP); error = EINVAL; break; } + memcpy(areq, &sc->areq, sizeof(*areq)); AN_UNLOCK(sc); - error = copyout(&sc->areq, ifr_data_get_ptr(ifr), - sizeof(sc->areq)); + error = copyout(areq, ifr_data_get_ptr(ifr), sizeof(*areq)); + free(areq, M_TEMP); break; case SIOCSAIRONET: if ((error = priv_check(td, PRIV_DRIVER)))