From nobody Wed Apr 06 03:26:06 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id DC7D51A8C031; Wed, 6 Apr 2022 03:26:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KY8zy5nt1z4nSG; Wed, 6 Apr 2022 03:26:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1649215566; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=s44cqIdrvLoPO7J1b160TbTE/dqf9P07oJ+43IOHH84=; b=PRsJtOUmH/+9Y5zOpqUTW7lM4nIymwNL3BlSh2p234GOhG80jk9jFE+unuvstGNvTu5v2d PLNuA4MQyjjroYpWsadksJDdPy/9BU52iZ553W7uItXXvhg5h+UpKPUvEFiyHlKXxZH4ZS krCQEfZNwF32ls+OIu5BV6ZOOyjcStbnE2X8BfdKNxuB6CoSKlyr4fT935wdxJxCR3dugs QFK/DNRYtHUW85ZBCXfEupNaWmzAYo6wyew0VEk38SB7qDTywKC14fDwW+4pODKf3PxBV8 3SVR8zQuMXl3I65D/BZfavJNhsJ+2N0QXRpdz5zw9Dvu29UKoC2bgoil4SWVfg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A717513826; Wed, 6 Apr 2022 03:26:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 2363Q6p9062327; Wed, 6 Apr 2022 03:26:06 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 2363Q6Tt062326; Wed, 6 Apr 2022 03:26:06 GMT (envelope-from git) Date: Wed, 6 Apr 2022 03:26:06 GMT Message-Id: <202204060326.2363Q6Tt062326@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: 9d354cf6e141 - releng/13.1 - netmap: Fix integer overflow in nmreq_copyin List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/releng/13.1 X-Git-Reftype: branch X-Git-Commit: 9d354cf6e141a55ad1ef0cb85316f39013d594d2 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1649215566; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=s44cqIdrvLoPO7J1b160TbTE/dqf9P07oJ+43IOHH84=; b=fqenG9c8AcNJFsm7Cb7k0/Yo2YR0jWcoxVnM/rcm1dulN18JQ9oYKA19duQQd7oSLEWFDt JEml3wmGnA70WXuqSmgtjUnVUFJQOdIYtJ0pXYE1MgcN6woMG36vmK8JlRSPW1EPl0Vla1 0OmH9AiV4NJaq9VGWzat0/pU4Zo6wlrOFSYp116MQpiA1VsR3RrZhAD1/nwgyFMoEyS01v +yqczBorpzvzLDgYvMhw+2JQyjrTFtCKPn7Rnje1m4kMEKYhYB8yyKOdSe9Mi86mV5hBiL CyWZBkIbw3YyMc2QMtPay3ULOlW61XixQ4lmlwPvnyxiOM/7QqHRD5Z1lA6yzw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1649215566; a=rsa-sha256; cv=none; b=xuoAvCQ0jpGG24V1++jJdsNqeY/bSaQEd5zo4WGY6zpNO1Awu6F0BPNia1gFfrId5oWfhF 26p9IzMLDkrrOT0TcQI1Uhh44JLlFV0wWRw3N9jUhH+an23r9qzRRWcO1R99N5pwQfLRyy +b3mEXmFpQHyvVP1c4FpV3g1F02KW/SgKoZD5+B2jyO3ODBwDZVSfVQ01zv68NMv6PPoSl GNh6RG4oVHT7kgcPoOJmtK8FPkY3i3qXojuqt+VxYpA+IsWX1cSiGdQLpuShZsbbcHpXIv Og9E8sLkYCZ2TRnFccGK5yAlEf4xvZBbsq+BZoHrUOy6Z6v4A5kxpzzVo2RtNA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch releng/13.1 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=9d354cf6e141a55ad1ef0cb85316f39013d594d2 commit 9d354cf6e141a55ad1ef0cb85316f39013d594d2 Author: Vincenzo Maffione AuthorDate: 2022-03-16 06:57:54 +0000 Commit: Ed Maste CommitDate: 2022-04-06 03:23:51 +0000 netmap: Fix integer overflow in nmreq_copyin An unsanitized field in an option could be abused, causing an integer overflow followed by kernel memory corruption. This might be used to escape jails/containers. Reported by: Reno Robert and Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative Security: CVE-2022-23085 (cherry picked from commit 694ea59c7021c25417e6d516362d2f59b4e2c343) (cherry picked from commit 9df8dd3ea36c8b3abe8fc182647472ca9cd83efd) Approved by: so, re (implicit) --- sys/dev/netmap/netmap.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/dev/netmap/netmap.c b/sys/dev/netmap/netmap.c index f9698096b47a..0c04098bb401 100644 --- a/sys/dev/netmap/netmap.c +++ b/sys/dev/netmap/netmap.c @@ -3096,7 +3096,7 @@ nmreq_opt_size_by_type(uint32_t nro_reqtype, uint64_t nro_size) int nmreq_copyin(struct nmreq_header *hdr, int nr_body_is_user) { - size_t rqsz, optsz, bufsz; + size_t rqsz, optsz, bufsz, optbodysz; int error = 0; char *ker = NULL, *p; struct nmreq_option **next, *src, **opt_tab; @@ -3144,8 +3144,18 @@ nmreq_copyin(struct nmreq_header *hdr, int nr_body_is_user) error = copyin(src, &buf, sizeof(*src)); if (error) goto out_err; + /* Validate nro_size to avoid integer overflow of optsz and bufsz. */ + if (buf.nro_size > NETMAP_REQ_MAXSIZE) { + error = EMSGSIZE; + goto out_err; + } optsz += sizeof(*src); - optsz += nmreq_opt_size_by_type(buf.nro_reqtype, buf.nro_size); + optbodysz = nmreq_opt_size_by_type(buf.nro_reqtype, buf.nro_size); + if (optbodysz > NETMAP_REQ_MAXSIZE) { + error = EMSGSIZE; + goto out_err; + } + optsz += optbodysz; if (rqsz + optsz > NETMAP_REQ_MAXSIZE) { error = EMSGSIZE; goto out_err;