From owner-svn-src-all@FreeBSD.ORG Tue Jun 3 19:03:25 2014 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 2E1DE50C; Tue, 3 Jun 2014 19:03:25 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 0E6192B77; Tue, 3 Jun 2014 19:03:25 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.8/8.14.8) with ESMTP id s53J3Ogt027712; Tue, 3 Jun 2014 19:03:24 GMT (envelope-from delphij@svn.freebsd.org) Received: (from delphij@localhost) by svn.freebsd.org (8.14.8/8.14.8/Submit) id s53J3N5R027701; Tue, 3 Jun 2014 19:03:23 GMT (envelope-from delphij@svn.freebsd.org) Message-Id: <201406031903.s53J3N5R027701@svn.freebsd.org> From: Xin LI Date: Tue, 3 Jun 2014 19:03:23 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r267019 - in releng/8.4: . contrib/sendmail/src sys/conf sys/kern sys/sys sys/vm X-SVN-Group: releng MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Jun 2014 19:03:25 -0000 Author: delphij Date: Tue Jun 3 19:03:23 2014 New Revision: 267019 URL: http://svnweb.freebsd.org/changeset/base/267019 Log: Fix sendmail improper close-on-exec flag handling. [SA-14:11] Fix ktrace memory disclosure. [SA-14:12] Fix triple-fault when executing from a threaded process. [EN-14:06] Approved by: so Modified: releng/8.4/UPDATING releng/8.4/contrib/sendmail/src/conf.c releng/8.4/sys/conf/newvers.sh releng/8.4/sys/kern/kern_exec.c releng/8.4/sys/kern/kern_ktrace.c releng/8.4/sys/sys/proc.h releng/8.4/sys/vm/vm_map.c Modified: releng/8.4/UPDATING ============================================================================== --- releng/8.4/UPDATING Tue Jun 3 19:03:11 2014 (r267018) +++ releng/8.4/UPDATING Tue Jun 3 19:03:23 2014 (r267019) @@ -15,6 +15,17 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 8. debugging tools present in HEAD were left in place because sun4v support still needs work to become production ready. +20140603: p11 FreeBSD-SA-14:11.sendmail + FreeBSD-SA-14:12.ktrace + FreeBSD-EN-14:06.exec + + Fix sendmail improper close-on-exec flag handling. [SA-14:11] + + Fix ktrace memory disclosure. [SA-14:12] + + Fix triple-fault when executing from a threaded process. + [EN-14:06] + 20140513: p10 FreeBSD-EN-14:03.pkg FreeBSD-EN-14:04.kldxref Modified: releng/8.4/contrib/sendmail/src/conf.c ============================================================================== --- releng/8.4/contrib/sendmail/src/conf.c Tue Jun 3 19:03:11 2014 (r267018) +++ releng/8.4/contrib/sendmail/src/conf.c Tue Jun 3 19:03:23 2014 (r267019) @@ -5265,8 +5265,8 @@ closefd_walk(lowest, fd) */ void -sm_close_on_exec(highest, lowest) - int highest, lowest; +sm_close_on_exec(lowest, highest) + int lowest, highest; { #if HASFDWALK (void) fdwalk(closefd_walk, &lowest); Modified: releng/8.4/sys/conf/newvers.sh ============================================================================== --- releng/8.4/sys/conf/newvers.sh Tue Jun 3 19:03:11 2014 (r267018) +++ releng/8.4/sys/conf/newvers.sh Tue Jun 3 19:03:23 2014 (r267019) @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="8.4" -BRANCH="RELEASE-p10" +BRANCH="RELEASE-p11" if [ "X${BRANCH_OVERRIDE}" != "X" ]; then BRANCH=${BRANCH_OVERRIDE} fi Modified: releng/8.4/sys/kern/kern_exec.c ============================================================================== --- releng/8.4/sys/kern/kern_exec.c Tue Jun 3 19:03:11 2014 (r267018) +++ releng/8.4/sys/kern/kern_exec.c Tue Jun 3 19:03:23 2014 (r267019) @@ -278,6 +278,7 @@ kern_execve(td, args, mac_p) struct mac *mac_p; { struct proc *p = td->td_proc; + struct vmspace *oldvmspace; int error; AUDIT_ARG_ARGV(args->begin_argv, args->argc, @@ -294,6 +295,8 @@ kern_execve(td, args, mac_p) PROC_UNLOCK(p); } + KASSERT((td->td_pflags & TDP_EXECVMSPC) == 0, ("nested execve")); + oldvmspace = td->td_proc->p_vmspace; error = do_execve(td, args, mac_p); if (p->p_flag & P_HADTHREADS) { @@ -308,6 +311,12 @@ kern_execve(td, args, mac_p) thread_single_end(); PROC_UNLOCK(p); } + if ((td->td_pflags & TDP_EXECVMSPC) != 0) { + KASSERT(td->td_proc->p_vmspace != oldvmspace, + ("oldvmspace still used")); + vmspace_free(oldvmspace); + td->td_pflags &= ~TDP_EXECVMSPC; + } return (error); } Modified: releng/8.4/sys/kern/kern_ktrace.c ============================================================================== --- releng/8.4/sys/kern/kern_ktrace.c Tue Jun 3 19:03:11 2014 (r267018) +++ releng/8.4/sys/kern/kern_ktrace.c Tue Jun 3 19:03:23 2014 (r267019) @@ -117,6 +117,7 @@ static int data_lengths[] = { 0, /* KTR_SYSCTL */ sizeof(struct ktr_proc_ctor), /* KTR_PROCCTOR */ 0, /* KTR_PROCDTOR */ + 0, /* unused */ sizeof(struct ktr_fault), /* KTR_FAULT */ sizeof(struct ktr_faultend), /* KTR_FAULTEND */ }; Modified: releng/8.4/sys/sys/proc.h ============================================================================== --- releng/8.4/sys/sys/proc.h Tue Jun 3 19:03:11 2014 (r267018) +++ releng/8.4/sys/sys/proc.h Tue Jun 3 19:03:23 2014 (r267019) @@ -938,4 +938,5 @@ curthread_pflags_restore(int save) #endif /* _KERNEL */ +#define TDP_EXECVMSPC 0x40000000 /* Execve destroyed old vmspace */ #endif /* !_SYS_PROC_H_ */ Modified: releng/8.4/sys/vm/vm_map.c ============================================================================== --- releng/8.4/sys/vm/vm_map.c Tue Jun 3 19:03:11 2014 (r267018) +++ releng/8.4/sys/vm/vm_map.c Tue Jun 3 19:03:23 2014 (r267019) @@ -3521,6 +3521,8 @@ vmspace_exec(struct proc *p, vm_offset_t struct vmspace *oldvmspace = p->p_vmspace; struct vmspace *newvmspace; + KASSERT((curthread->td_pflags & TDP_EXECVMSPC) == 0, + ("vmspace_exec recursed")); newvmspace = vmspace_alloc(minuser, maxuser); if (newvmspace == NULL) return (ENOMEM); @@ -3537,7 +3539,7 @@ vmspace_exec(struct proc *p, vm_offset_t PROC_VMSPACE_UNLOCK(p); if (p == curthread->td_proc) pmap_activate(curthread); - vmspace_free(oldvmspace); + curthread->td_pflags |= TDP_EXECVMSPC; return (0); }