Date: Tue, 8 Jul 2014 22:47:07 GMT From: op@FreeBSD.org To: svn-soc-all@FreeBSD.org Subject: socsvn commit: r270625 - in soc2014/op/freebsd-base: . bin/sh/tests/builtins sys sys/amd64/include sys/amd64/vmm sys/amd64/vmm/intel sys/kern sys/netinet tools/build/mk Message-ID: <201407082247.s68Ml7Ag055051@socsvn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: op Date: Tue Jul 8 22:47:05 2014 New Revision: 270625 URL: http://svnweb.FreeBSD.org/socsvn/?view=rev&rev=270625 Log: MFH @20140709 after CVEs Signed-off-by: Oliver Pinter <oliver.pntr@gmail.com> Modified: soc2014/op/freebsd-base/ (props changed) soc2014/op/freebsd-base/bin/sh/tests/builtins/Makefile soc2014/op/freebsd-base/sys/ (props changed) soc2014/op/freebsd-base/sys/amd64/include/vmm.h (contents, props changed) soc2014/op/freebsd-base/sys/amd64/vmm/ (props changed) soc2014/op/freebsd-base/sys/amd64/vmm/intel/vmx.c soc2014/op/freebsd-base/sys/kern/uipc_sockbuf.c soc2014/op/freebsd-base/sys/netinet/sctp_auth.c soc2014/op/freebsd-base/sys/netinet/sctp_indata.c soc2014/op/freebsd-base/sys/netinet/sctputil.c soc2014/op/freebsd-base/tools/build/mk/OptionalObsoleteFiles.inc Modified: soc2014/op/freebsd-base/bin/sh/tests/builtins/Makefile ============================================================================== --- soc2014/op/freebsd-base/bin/sh/tests/builtins/Makefile Tue Jul 8 22:20:28 2014 (r270624) +++ soc2014/op/freebsd-base/bin/sh/tests/builtins/Makefile Tue Jul 8 22:47:05 2014 (r270625) @@ -99,7 +99,9 @@ FILES+= local2.0 FILES+= local3.0 FILES+= local4.0 +.if ${MK_NLS} != "no" FILES+= locale1.0 +.endif FILES+= printf1.0 FILES+= printf2.0 FILES+= printf3.0 Modified: soc2014/op/freebsd-base/sys/amd64/include/vmm.h ============================================================================== --- soc2014/op/freebsd-base/sys/amd64/include/vmm.h Tue Jul 8 22:20:28 2014 (r270624) +++ soc2014/op/freebsd-base/sys/amd64/include/vmm.h Tue Jul 8 22:47:05 2014 (r270625) @@ -329,6 +329,8 @@ #define SEG_DESC_UNUSABLE(desc) ((desc)->access & 0x10000) enum vm_cpu_mode { + CPU_MODE_REAL, + CPU_MODE_PROTECTED, CPU_MODE_COMPATIBILITY, /* IA-32E mode (CS.L = 0) */ CPU_MODE_64BIT, /* IA-32E mode (CS.L = 1) */ }; Modified: soc2014/op/freebsd-base/sys/amd64/vmm/intel/vmx.c ============================================================================== --- soc2014/op/freebsd-base/sys/amd64/vmm/intel/vmx.c Tue Jul 8 22:20:28 2014 (r270624) +++ soc2014/op/freebsd-base/sys/amd64/vmm/intel/vmx.c Tue Jul 8 22:47:05 2014 (r270625) @@ -1687,11 +1687,19 @@ static enum vm_cpu_mode vmx_cpu_mode(void) { + uint32_t csar; - if (vmcs_read(VMCS_GUEST_IA32_EFER) & EFER_LMA) - return (CPU_MODE_64BIT); - else - return (CPU_MODE_COMPATIBILITY); + if (vmcs_read(VMCS_GUEST_IA32_EFER) & EFER_LMA) { + csar = vmcs_read(VMCS_GUEST_CS_ACCESS_RIGHTS); + if (csar & 0x2000) + return (CPU_MODE_64BIT); /* CS.L = 1 */ + else + return (CPU_MODE_COMPATIBILITY); + } else if (vmcs_read(VMCS_GUEST_CR0) & CR0_PE) { + return (CPU_MODE_PROTECTED); + } else { + return (CPU_MODE_REAL); + } } static enum vm_paging_mode Modified: soc2014/op/freebsd-base/sys/kern/uipc_sockbuf.c ============================================================================== --- soc2014/op/freebsd-base/sys/kern/uipc_sockbuf.c Tue Jul 8 22:20:28 2014 (r270624) +++ soc2014/op/freebsd-base/sys/kern/uipc_sockbuf.c Tue Jul 8 22:47:05 2014 (r270625) @@ -1071,6 +1071,11 @@ m->m_len = 0; KASSERT(CMSG_SPACE((u_int)size) <= M_TRAILINGSPACE(m), ("sbcreatecontrol: short mbuf")); + /* + * Don't leave the padding between the msg header and the + * cmsg data and the padding after the cmsg data un-initialized. + */ + bzero(cp, CMSG_SPACE((u_int)size)); if (p != NULL) (void)memcpy(CMSG_DATA(cp), p, size); m->m_len = CMSG_SPACE(size); Modified: soc2014/op/freebsd-base/sys/netinet/sctp_auth.c ============================================================================== --- soc2014/op/freebsd-base/sys/netinet/sctp_auth.c Tue Jul 8 22:20:28 2014 (r270624) +++ soc2014/op/freebsd-base/sys/netinet/sctp_auth.c Tue Jul 8 22:47:05 2014 (r270625) @@ -1790,6 +1790,7 @@ SCTP_BUF_LEN(m_notify) = 0; auth = mtod(m_notify, struct sctp_authkey_event *); + memset(auth, 0, sizeof(struct sctp_authkey_event)); auth->auth_type = SCTP_AUTHENTICATION_EVENT; auth->auth_flags = 0; auth->auth_length = sizeof(*auth); Modified: soc2014/op/freebsd-base/sys/netinet/sctp_indata.c ============================================================================== --- soc2014/op/freebsd-base/sys/netinet/sctp_indata.c Tue Jul 8 22:20:28 2014 (r270624) +++ soc2014/op/freebsd-base/sys/netinet/sctp_indata.c Tue Jul 8 22:47:05 2014 (r270625) @@ -250,6 +250,11 @@ /* We need a CMSG header followed by the struct */ cmh = mtod(ret, struct cmsghdr *); + /* + * Make sure that there is no un-initialized padding between the + * cmsg header and cmsg data and after the cmsg data. + */ + memset(cmh, 0, len); if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) { cmh->cmsg_level = IPPROTO_SCTP; cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_rcvinfo)); Modified: soc2014/op/freebsd-base/sys/netinet/sctputil.c ============================================================================== --- soc2014/op/freebsd-base/sys/netinet/sctputil.c Tue Jul 8 22:20:28 2014 (r270624) +++ soc2014/op/freebsd-base/sys/netinet/sctputil.c Tue Jul 8 22:47:05 2014 (r270625) @@ -2622,6 +2622,7 @@ } SCTP_BUF_NEXT(m_notify) = NULL; sac = mtod(m_notify, struct sctp_assoc_change *); + memset(sac, 0, notif_len); sac->sac_type = SCTP_ASSOC_CHANGE; sac->sac_flags = 0; sac->sac_length = sizeof(struct sctp_assoc_change); @@ -2835,21 +2836,21 @@ if (m_notify == NULL) /* no space left */ return; - length += chk->send_size; - length -= sizeof(struct sctp_data_chunk); SCTP_BUF_LEN(m_notify) = 0; if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { ssfe = mtod(m_notify, struct sctp_send_failed_event *); + memset(ssfe, 0, length); ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; if (sent) { ssfe->ssfe_flags = SCTP_DATA_SENT; } else { ssfe->ssfe_flags = SCTP_DATA_UNSENT; } + length += chk->send_size; + length -= sizeof(struct sctp_data_chunk); ssfe->ssfe_length = length; ssfe->ssfe_error = error; /* not exactly what the user sent in, but should be close :) */ - bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info)); ssfe->ssfe_info.snd_sid = chk->rec.data.stream_number; ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags; ssfe->ssfe_info.snd_ppid = chk->rec.data.payloadtype; @@ -2859,12 +2860,15 @@ SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event); } else { ssf = mtod(m_notify, struct sctp_send_failed *); + memset(ssf, 0, length); ssf->ssf_type = SCTP_SEND_FAILED; if (sent) { ssf->ssf_flags = SCTP_DATA_SENT; } else { ssf->ssf_flags = SCTP_DATA_UNSENT; } + length += chk->send_size; + length -= sizeof(struct sctp_data_chunk); ssf->ssf_length = length; ssf->ssf_error = error; /* not exactly what the user sent in, but should be close :) */ @@ -2948,16 +2952,16 @@ /* no space left */ return; } - length += sp->length; SCTP_BUF_LEN(m_notify) = 0; if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { ssfe = mtod(m_notify, struct sctp_send_failed_event *); + memset(ssfe, 0, length); ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; ssfe->ssfe_flags = SCTP_DATA_UNSENT; + length += sp->length; ssfe->ssfe_length = length; ssfe->ssfe_error = error; /* not exactly what the user sent in, but should be close :) */ - bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info)); ssfe->ssfe_info.snd_sid = sp->stream; if (sp->some_taken) { ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG; @@ -2971,12 +2975,13 @@ SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event); } else { ssf = mtod(m_notify, struct sctp_send_failed *); + memset(ssf, 0, length); ssf->ssf_type = SCTP_SEND_FAILED; ssf->ssf_flags = SCTP_DATA_UNSENT; + length += sp->length; ssf->ssf_length = length; ssf->ssf_error = error; /* not exactly what the user sent in, but should be close :) */ - bzero(&ssf->ssf_info, sizeof(ssf->ssf_info)); ssf->ssf_info.sinfo_stream = sp->stream; ssf->ssf_info.sinfo_ssn = 0; if (sp->some_taken) { @@ -3038,6 +3043,7 @@ return; SCTP_BUF_LEN(m_notify) = 0; sai = mtod(m_notify, struct sctp_adaptation_event *); + memset(sai, 0, sizeof(struct sctp_adaptation_event)); sai->sai_type = SCTP_ADAPTATION_INDICATION; sai->sai_flags = 0; sai->sai_length = sizeof(struct sctp_adaptation_event); @@ -3093,6 +3099,7 @@ return; SCTP_BUF_LEN(m_notify) = 0; pdapi = mtod(m_notify, struct sctp_pdapi_event *); + memset(pdapi, 0, sizeof(struct sctp_pdapi_event)); pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT; pdapi->pdapi_flags = 0; pdapi->pdapi_length = sizeof(struct sctp_pdapi_event); @@ -3202,6 +3209,7 @@ /* no space left */ return; sse = mtod(m_notify, struct sctp_shutdown_event *); + memset(sse, 0, sizeof(struct sctp_shutdown_event)); sse->sse_type = SCTP_SHUTDOWN_EVENT; sse->sse_flags = 0; sse->sse_length = sizeof(struct sctp_shutdown_event); @@ -3252,6 +3260,7 @@ } SCTP_BUF_LEN(m_notify) = 0; event = mtod(m_notify, struct sctp_sender_dry_event *); + memset(event, 0, sizeof(struct sctp_sender_dry_event)); event->sender_dry_type = SCTP_SENDER_DRY_EVENT; event->sender_dry_flags = 0; event->sender_dry_length = sizeof(struct sctp_sender_dry_event); @@ -3284,7 +3293,6 @@ struct mbuf *m_notify; struct sctp_queued_to_read *control; struct sctp_stream_change_event *stradd; - int len; if ((stcb == NULL) || (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) { @@ -3297,25 +3305,20 @@ return; } stcb->asoc.peer_req_out = 0; - m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); + m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA); if (m_notify == NULL) /* no space left */ return; SCTP_BUF_LEN(m_notify) = 0; - len = sizeof(struct sctp_stream_change_event); - if (len > M_TRAILINGSPACE(m_notify)) { - /* never enough room */ - sctp_m_freem(m_notify); - return; - } stradd = mtod(m_notify, struct sctp_stream_change_event *); + memset(stradd, 0, sizeof(struct sctp_stream_change_event)); stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT; stradd->strchange_flags = flag; - stradd->strchange_length = len; + stradd->strchange_length = sizeof(struct sctp_stream_change_event); stradd->strchange_assoc_id = sctp_get_associd(stcb); stradd->strchange_instrms = numberin; stradd->strchange_outstrms = numberout; - SCTP_BUF_LEN(m_notify) = len; + SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event); SCTP_BUF_NEXT(m_notify) = NULL; if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { /* no space */ @@ -3346,32 +3349,26 @@ struct mbuf *m_notify; struct sctp_queued_to_read *control; struct sctp_assoc_reset_event *strasoc; - int len; if ((stcb == NULL) || (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) { /* event not enabled */ return; } - m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); + m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA); if (m_notify == NULL) /* no space left */ return; SCTP_BUF_LEN(m_notify) = 0; - len = sizeof(struct sctp_assoc_reset_event); - if (len > M_TRAILINGSPACE(m_notify)) { - /* never enough room */ - sctp_m_freem(m_notify); - return; - } strasoc = mtod(m_notify, struct sctp_assoc_reset_event *); + memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event)); strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT; strasoc->assocreset_flags = flag; - strasoc->assocreset_length = len; + strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event); strasoc->assocreset_assoc_id = sctp_get_associd(stcb); strasoc->assocreset_local_tsn = sending_tsn; strasoc->assocreset_remote_tsn = recv_tsn; - SCTP_BUF_LEN(m_notify) = len; + SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event); SCTP_BUF_NEXT(m_notify) = NULL; if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { /* no space */ @@ -3424,6 +3421,7 @@ return; } strreset = mtod(m_notify, struct sctp_stream_reset_event *); + memset(strreset, 0, len); strreset->strreset_type = SCTP_STREAM_RESET_EVENT; strreset->strreset_flags = flag; strreset->strreset_length = len; @@ -6236,9 +6234,12 @@ fromlen = 0; } + if (filling_sinfo) { + memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo)); + } error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp, (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo); - if ((controlp) && (filling_sinfo)) { + if (controlp != NULL) { /* copy back the sinfo in a CMSG format */ if (filling_sinfo) *controlp = sctp_build_ctl_nchunk(inp, Modified: soc2014/op/freebsd-base/tools/build/mk/OptionalObsoleteFiles.inc ============================================================================== --- soc2014/op/freebsd-base/tools/build/mk/OptionalObsoleteFiles.inc Tue Jul 8 22:20:28 2014 (r270624) +++ soc2014/op/freebsd-base/tools/build/mk/OptionalObsoleteFiles.inc Tue Jul 8 22:47:05 2014 (r270625) @@ -3382,9 +3382,10 @@ OLD_FILES+=var/yp/Makefile.dist .endif -#.if ${MK_NLS} == no +.if ${MK_NLS} == no +OLD_FILES+=usr/tests/bin/sh/builtins/locale1.0 # to be filled in -#.endif +.endif .if ${MK_NTP} == no OLD_FILES+=etc/ntp.conf
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201407082247.s68Ml7Ag055051>