Date: Tue, 3 Jun 2014 19:03:11 +0000 (UTC) From: Xin LI <delphij@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r267018 - in releng: 9.1 9.1/contrib/sendmail/src 9.1/sys/conf 9.1/sys/kern 9.1/sys/sys 9.1/sys/vm 9.2 9.2/contrib/openpam/lib 9.2/contrib/sendmail/src 9.2/sys/conf 9.2/sys/kern 9.2/sys... Message-ID: <201406031903.s53J3Bhb027614@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: delphij Date: Tue Jun 3 19:03:11 2014 New Revision: 267018 URL: http://svnweb.freebsd.org/changeset/base/267018 Log: Fix sendmail improper close-on-exec flag handling. [SA-14:11] Fix ktrace memory disclosure. [SA-14:12] Fix incorrect error handling in PAM policy parser. [SA-14:13] Fix triple-fault when executing from a threaded process. [EN-14:06] Approved by: so Modified: releng/9.1/UPDATING releng/9.1/contrib/sendmail/src/conf.c releng/9.1/sys/conf/newvers.sh releng/9.1/sys/kern/kern_exec.c releng/9.1/sys/kern/kern_ktrace.c releng/9.1/sys/sys/proc.h releng/9.1/sys/vm/vm_map.c releng/9.2/UPDATING releng/9.2/contrib/openpam/lib/openpam_configure.c releng/9.2/contrib/sendmail/src/conf.c releng/9.2/sys/conf/newvers.sh releng/9.2/sys/kern/kern_exec.c releng/9.2/sys/kern/kern_ktrace.c releng/9.2/sys/sys/proc.h releng/9.2/sys/vm/vm_map.c Modified: releng/9.1/UPDATING ============================================================================== --- releng/9.1/UPDATING Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.1/UPDATING Tue Jun 3 19:03:11 2014 (r267018) @@ -9,6 +9,20 @@ handbook. Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before running portupgrade. +20140603: p14 FreeBSD-SA-14:11.sendmail + FreeBSD-SA-14:12.ktrace + FreeBSD-SA-14:13.pam + FreeBSD-EN-14:06.exec + + Fix sendmail improper close-on-exec flag handling. [SA-14:11] + + Fix ktrace memory disclosure. [SA-14:12] + + Fix incorrect error handling in PAM policy parser. [SA-14:13] + + Fix triple-fault when executing from a threaded process. + [EN-14:06] + 20140513: p13 FreeBSD-EN-14:03.pkg FreeBSD-EN-14:04.kldxref FreeBSD-EN-14:05.ciss Modified: releng/9.1/contrib/sendmail/src/conf.c ============================================================================== --- releng/9.1/contrib/sendmail/src/conf.c Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.1/contrib/sendmail/src/conf.c Tue Jun 3 19:03:11 2014 (r267018) @@ -5256,8 +5256,8 @@ closefd_walk(lowest, fd) */ void -sm_close_on_exec(highest, lowest) - int highest, lowest; +sm_close_on_exec(lowest, highest) + int lowest, highest; { #if HASFDWALK (void) fdwalk(closefd_walk, &lowest); Modified: releng/9.1/sys/conf/newvers.sh ============================================================================== --- releng/9.1/sys/conf/newvers.sh Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.1/sys/conf/newvers.sh Tue Jun 3 19:03:11 2014 (r267018) @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="9.1" -BRANCH="RELEASE-p13" +BRANCH="RELEASE-p14" if [ "X${BRANCH_OVERRIDE}" != "X" ]; then BRANCH=${BRANCH_OVERRIDE} fi Modified: releng/9.1/sys/kern/kern_exec.c ============================================================================== --- releng/9.1/sys/kern/kern_exec.c Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.1/sys/kern/kern_exec.c Tue Jun 3 19:03:11 2014 (r267018) @@ -280,6 +280,7 @@ kern_execve(td, args, mac_p) struct mac *mac_p; { struct proc *p = td->td_proc; + struct vmspace *oldvmspace; int error; AUDIT_ARG_ARGV(args->begin_argv, args->argc, @@ -296,6 +297,8 @@ kern_execve(td, args, mac_p) PROC_UNLOCK(p); } + KASSERT((td->td_pflags & TDP_EXECVMSPC) == 0, ("nested execve")); + oldvmspace = td->td_proc->p_vmspace; error = do_execve(td, args, mac_p); if (p->p_flag & P_HADTHREADS) { @@ -310,6 +313,12 @@ kern_execve(td, args, mac_p) thread_single_end(); PROC_UNLOCK(p); } + if ((td->td_pflags & TDP_EXECVMSPC) != 0) { + KASSERT(td->td_proc->p_vmspace != oldvmspace, + ("oldvmspace still used")); + vmspace_free(oldvmspace); + td->td_pflags &= ~TDP_EXECVMSPC; + } return (error); } Modified: releng/9.1/sys/kern/kern_ktrace.c ============================================================================== --- releng/9.1/sys/kern/kern_ktrace.c Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.1/sys/kern/kern_ktrace.c Tue Jun 3 19:03:11 2014 (r267018) @@ -119,6 +119,7 @@ static int data_lengths[] = { 0, /* KTR_SYSCTL */ sizeof(struct ktr_proc_ctor), /* KTR_PROCCTOR */ 0, /* KTR_PROCDTOR */ + 0, /* unused */ sizeof(struct ktr_fault), /* KTR_FAULT */ sizeof(struct ktr_faultend), /* KTR_FAULTEND */ }; Modified: releng/9.1/sys/sys/proc.h ============================================================================== --- releng/9.1/sys/sys/proc.h Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.1/sys/sys/proc.h Tue Jun 3 19:03:11 2014 (r267018) @@ -968,4 +968,5 @@ curthread_pflags_restore(int save) #endif /* _KERNEL */ +#define TDP_EXECVMSPC 0x40000000 /* Execve destroyed old vmspace */ #endif /* !_SYS_PROC_H_ */ Modified: releng/9.1/sys/vm/vm_map.c ============================================================================== --- releng/9.1/sys/vm/vm_map.c Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.1/sys/vm/vm_map.c Tue Jun 3 19:03:11 2014 (r267018) @@ -3631,6 +3631,8 @@ vmspace_exec(struct proc *p, vm_offset_t struct vmspace *oldvmspace = p->p_vmspace; struct vmspace *newvmspace; + KASSERT((curthread->td_pflags & TDP_EXECVMSPC) == 0, + ("vmspace_exec recursed")); newvmspace = vmspace_alloc(minuser, maxuser); if (newvmspace == NULL) return (ENOMEM); @@ -3647,7 +3649,7 @@ vmspace_exec(struct proc *p, vm_offset_t PROC_VMSPACE_UNLOCK(p); if (p == curthread->td_proc) pmap_activate(curthread); - vmspace_free(oldvmspace); + curthread->td_pflags |= TDP_EXECVMSPC; return (0); } Modified: releng/9.2/UPDATING ============================================================================== --- releng/9.2/UPDATING Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.2/UPDATING Tue Jun 3 19:03:11 2014 (r267018) @@ -11,6 +11,20 @@ handbook: Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before running portupgrade. +20140603: p7 FreeBSD-SA-14:11.sendmail + FreeBSD-SA-14:12.ktrace + FreeBSD-SA-14:13.pam + FreeBSD-EN-14:06.exec + + Fix sendmail improper close-on-exec flag handling. [SA-14:11] + + Fix ktrace memory disclosure. [SA-14:12] + + Fix incorrect error handling in PAM policy parser. [SA-14:13] + + Fix triple-fault when executing from a threaded process. + [EN-14:06] + 20140513: p6 FreeBSD-EN-14:03.pkg FreeBSD-EN-14:04.kldxref FreeBSD-EN-14:05.ciss Modified: releng/9.2/contrib/openpam/lib/openpam_configure.c ============================================================================== --- releng/9.2/contrib/openpam/lib/openpam_configure.c Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.2/contrib/openpam/lib/openpam_configure.c Tue Jun 3 19:03:11 2014 (r267018) @@ -1,6 +1,6 @@ /*- * Copyright (c) 2001-2003 Networks Associates Technology, Inc. - * Copyright (c) 2004-2012 Dag-Erling Smørgrav + * Copyright (c) 2004-2014 Dag-Erling Smørgrav * All rights reserved. * * This software was developed for the FreeBSD Project by ThinkSec AS and @@ -194,6 +194,7 @@ openpam_parse_chain(pam_handle_t *pamh, openpam_log(PAM_LOG_ERROR, "%s(%d): missing or invalid facility", filename, lineno); + errno = EINVAL; goto fail; } if (facility != fclt && facility != PAM_FACILITY_ANY) { @@ -209,18 +210,28 @@ openpam_parse_chain(pam_handle_t *pamh, openpam_log(PAM_LOG_ERROR, "%s(%d): missing or invalid service name", filename, lineno); + errno = EINVAL; goto fail; } if (wordv[i] != NULL) { openpam_log(PAM_LOG_ERROR, "%s(%d): garbage at end of line", filename, lineno); + errno = EINVAL; goto fail; } ret = openpam_load_chain(pamh, servicename, fclt); FREEV(wordc, wordv); - if (ret < 0) + if (ret < 0) { + /* + * Bogus errno, but this ensures that the + * outer loop does not just ignore the + * error and keep searching. + */ + if (errno == ENOENT) + errno = EINVAL; goto fail; + } continue; } @@ -230,6 +241,7 @@ openpam_parse_chain(pam_handle_t *pamh, openpam_log(PAM_LOG_ERROR, "%s(%d): missing or invalid control flag", filename, lineno); + errno = EINVAL; goto fail; } @@ -239,6 +251,7 @@ openpam_parse_chain(pam_handle_t *pamh, openpam_log(PAM_LOG_ERROR, "%s(%d): missing or invalid module name", filename, lineno); + errno = EINVAL; goto fail; } @@ -248,8 +261,11 @@ openpam_parse_chain(pam_handle_t *pamh, this->flag = ctlf; /* load module */ - if ((this->module = openpam_load_module(modulename)) == NULL) + if ((this->module = openpam_load_module(modulename)) == NULL) { + if (errno == ENOENT) + errno = ENOEXEC; goto fail; + } /* * The remaining items in wordv are the module's @@ -282,7 +298,11 @@ openpam_parse_chain(pam_handle_t *pamh, * The loop ended because openpam_readword() returned NULL, which * can happen for four different reasons: an I/O error (ferror(f) * is true), a memory allocation failure (ferror(f) is false, - * errno is non-zero) + * feof(f) is false, errno is non-zero), the file ended with an + * unterminated quote or backslash escape (ferror(f) is false, + * feof(f) is true, errno is non-zero), or the end of the file was + * reached without error (ferror(f) is false, feof(f) is true, + * errno is zero). */ if (ferror(f) || errno != 0) goto syserr; @@ -411,6 +431,9 @@ openpam_load_chain(pam_handle_t *pamh, } ret = openpam_load_file(pamh, service, facility, filename, style); + /* success */ + if (ret > 0) + RETURNN(ret); /* the file exists, but an error occurred */ if (ret == -1 && errno != ENOENT) RETURNN(ret); @@ -420,7 +443,8 @@ openpam_load_chain(pam_handle_t *pamh, } /* no hit */ - RETURNN(0); + errno = ENOENT; + RETURNN(-1); } /* @@ -441,8 +465,10 @@ openpam_configure(pam_handle_t *pamh, openpam_log(PAM_LOG_ERROR, "invalid service name"); RETURNC(PAM_SYSTEM_ERR); } - if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0) - goto load_err; + if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0) { + if (errno != ENOENT) + goto load_err; + } for (fclt = 0; fclt < PAM_NUM_FACILITIES; ++fclt) { if (pamh->chains[fclt] != NULL) continue; Modified: releng/9.2/contrib/sendmail/src/conf.c ============================================================================== --- releng/9.2/contrib/sendmail/src/conf.c Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.2/contrib/sendmail/src/conf.c Tue Jun 3 19:03:11 2014 (r267018) @@ -5265,8 +5265,8 @@ closefd_walk(lowest, fd) */ void -sm_close_on_exec(highest, lowest) - int highest, lowest; +sm_close_on_exec(lowest, highest) + int lowest, highest; { #if HASFDWALK (void) fdwalk(closefd_walk, &lowest); Modified: releng/9.2/sys/conf/newvers.sh ============================================================================== --- releng/9.2/sys/conf/newvers.sh Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.2/sys/conf/newvers.sh Tue Jun 3 19:03:11 2014 (r267018) @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="9.2" -BRANCH="RELEASE-p6" +BRANCH="RELEASE-p7" if [ "X${BRANCH_OVERRIDE}" != "X" ]; then BRANCH=${BRANCH_OVERRIDE} fi Modified: releng/9.2/sys/kern/kern_exec.c ============================================================================== --- releng/9.2/sys/kern/kern_exec.c Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.2/sys/kern/kern_exec.c Tue Jun 3 19:03:11 2014 (r267018) @@ -280,6 +280,7 @@ kern_execve(td, args, mac_p) struct mac *mac_p; { struct proc *p = td->td_proc; + struct vmspace *oldvmspace; int error; AUDIT_ARG_ARGV(args->begin_argv, args->argc, @@ -296,6 +297,8 @@ kern_execve(td, args, mac_p) PROC_UNLOCK(p); } + KASSERT((td->td_pflags & TDP_EXECVMSPC) == 0, ("nested execve")); + oldvmspace = td->td_proc->p_vmspace; error = do_execve(td, args, mac_p); if (p->p_flag & P_HADTHREADS) { @@ -310,6 +313,12 @@ kern_execve(td, args, mac_p) thread_single_end(); PROC_UNLOCK(p); } + if ((td->td_pflags & TDP_EXECVMSPC) != 0) { + KASSERT(td->td_proc->p_vmspace != oldvmspace, + ("oldvmspace still used")); + vmspace_free(oldvmspace); + td->td_pflags &= ~TDP_EXECVMSPC; + } return (error); } Modified: releng/9.2/sys/kern/kern_ktrace.c ============================================================================== --- releng/9.2/sys/kern/kern_ktrace.c Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.2/sys/kern/kern_ktrace.c Tue Jun 3 19:03:11 2014 (r267018) @@ -119,6 +119,7 @@ static int data_lengths[] = { 0, /* KTR_SYSCTL */ sizeof(struct ktr_proc_ctor), /* KTR_PROCCTOR */ 0, /* KTR_PROCDTOR */ + 0, /* unused */ sizeof(struct ktr_fault), /* KTR_FAULT */ sizeof(struct ktr_faultend), /* KTR_FAULTEND */ }; Modified: releng/9.2/sys/sys/proc.h ============================================================================== --- releng/9.2/sys/sys/proc.h Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.2/sys/sys/proc.h Tue Jun 3 19:03:11 2014 (r267018) @@ -977,4 +977,5 @@ curthread_pflags_restore(int save) #endif /* _KERNEL */ +#define TDP_EXECVMSPC 0x40000000 /* Execve destroyed old vmspace */ #endif /* !_SYS_PROC_H_ */ Modified: releng/9.2/sys/vm/vm_map.c ============================================================================== --- releng/9.2/sys/vm/vm_map.c Tue Jun 3 19:02:52 2014 (r267017) +++ releng/9.2/sys/vm/vm_map.c Tue Jun 3 19:03:11 2014 (r267018) @@ -3669,6 +3669,8 @@ vmspace_exec(struct proc *p, vm_offset_t struct vmspace *oldvmspace = p->p_vmspace; struct vmspace *newvmspace; + KASSERT((curthread->td_pflags & TDP_EXECVMSPC) == 0, + ("vmspace_exec recursed")); newvmspace = vmspace_alloc(minuser, maxuser); if (newvmspace == NULL) return (ENOMEM); @@ -3685,7 +3687,7 @@ vmspace_exec(struct proc *p, vm_offset_t PROC_VMSPACE_UNLOCK(p); if (p == curthread->td_proc) pmap_activate(curthread); - vmspace_free(oldvmspace); + curthread->td_pflags |= TDP_EXECVMSPC; return (0); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201406031903.s53J3Bhb027614>