From nobody Fri Nov 15 13:00:48 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XqcZn3Z3Wz5d6gQ; Fri, 15 Nov 2024 13:00:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XqcZn1Fllz4pXR; Fri, 15 Nov 2024 13:00:49 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731675649; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=92l7M5PKmk8i+LnGpYqDvRgnxrw3lMlNgzqJah+uW1s=; b=A6E6ChVeT+QM7QABdUzHgJO47DSTakN8MMboMHCpccmaXeq2ocfeyiCA340pPYAdfymjcR E4dVzeVIrV4R+E/9RkG41FcpY1Zu39f91TducGlPnU7xPY606SIK3YON1NAinTOFsnZDpr wLSjBVZQWiZuGkSlbqK5+kKPNkmrqE5Tb/Qxv0RvxT2LmCc0BoL5wj7rsvoNMuXSsQzLTv YIqJ8R3Th6HNy/WgPoonNfV8Gbzje3leIx49UaoLWbqBKy296UUwTV64OXSWbKao/+PMEe LiZ+cfKYUOddO0h5+CfPBkE+IYKoolivNUfSvdn9KsX+4m4Y0L3vtytgg5graQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731675649; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=92l7M5PKmk8i+LnGpYqDvRgnxrw3lMlNgzqJah+uW1s=; b=p4NT/tf/IuuWqtlYFsBEEb6oLrsqxH/YOWSfFMQXmhfbcmwqrcriljx+PYW/5XrAPY2WTx l24r6bwaOtBb94WwqP3djyryz1vCS/qHKfq0oMOyN5XqcjT4t6ya+IodtWtpKzm0XSjTmJ Os6x0g7ZB2NJkDlnbjyBGJK3hQSOnX4DDQ5EWSyPW/P8bS0kGOThw5yF8aK1/yAmeO3ypp FzJUF4XZvR5PhZHHO7JUvjSy+f89YDfZ4pCtcIdKHU3W4695PNr3XUQg1xroaY5bqwp2Ds tNal/YDc0iKvntGUx+RrIqP30j3rlO1IMxZBKq2ugPD9zSbfot2CRUIJSLeBag== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1731675649; a=rsa-sha256; cv=none; b=x5r1HPzaYk3TuEXftMmARJtInOe4PD+bmpvw5hrjA1cmJZ/jqyGiMhL2rLzEzGoavYS53v eJi0LRvRRZk433rOke3kWK3vl1hDotQkir0xPvRP2tvzKhQYSjecnV4Kgw07+nWYFdeIct j6rvZTJDvkfxkdsIEfhwOzF2T7iInMkQTxpU/6lkCn8wDTTzRGSs8PFBRFH9Uz2M/IhTQb W5cZtDtoW8eWcFL7HMHcdvGUJKmOMILXyc26MaQzl/QCCPuktzo+p/ZYqCh45dnarUD6UN 7kz+TpXkjG+FcIx1loSNyVQ2wUx6+lm8Q5pKbC9N7zprbyiGteISvoveea4DkA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XqcZn0b9TzNs7; Fri, 15 Nov 2024 13:00:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4AFD0mfd071113; Fri, 15 Nov 2024 13:00:48 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4AFD0mm5071108; Fri, 15 Nov 2024 13:00:48 GMT (envelope-from git) Date: Fri, 15 Nov 2024 13:00:48 GMT Message-Id: <202411151300.4AFD0mm5071108@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 50e3e905e409 - stable/13 - cred: 'kern.ngroups' tunable: Limit it to avoid internal overflows List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 50e3e905e409a8f6387328326c5dc37a4fbbcdd8 Auto-Submitted: auto-generated The branch stable/13 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=50e3e905e409a8f6387328326c5dc37a4fbbcdd8 commit 50e3e905e409a8f6387328326c5dc37a4fbbcdd8 Author: Olivier Certner AuthorDate: 2024-10-01 17:00:43 +0000 Commit: Olivier Certner CommitDate: 2024-11-15 12:59:08 +0000 cred: 'kern.ngroups' tunable: Limit it to avoid internal overflows As the comment introduced with the tunable said (but the code didn't do), make sure that 'ngroups_max' can't be INT_MAX, as this would cause overflow in the usual 'ngroups_max + 1' computations (as we store the effective GID and supplementary groups' IDs in the same array, and 'ngroups_max' only applies to supplementary groups). Further, we limit the maximum number of groups somewhat arbitrarily to ~17M so as to avoid overflow when computing the size in bytes of the groups set's backing array and to avoid obvious configuration errors. We really don't think that more than ~17M groups will ever be needed (if I'm proven wrong one day, please drop me a note about your use case). While here, document more precisely why NGROUPS_MAX needs to be the minimum value for 'ngroups_max'. Reviewed by: mhorne (older version) Approved by: markj (mentor) MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D46913 (cherry picked from commit 580904d995d53ccd2492140a37107442d8b36dc0) Approved by: markj (mentor) --- sys/kern/subr_param.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/sys/kern/subr_param.c b/sys/kern/subr_param.c index 0ea2279ef2e6..c976bd4cc029 100644 --- a/sys/kern/subr_param.c +++ b/sys/kern/subr_param.c @@ -235,14 +235,32 @@ init_param1(void) TUNABLE_ULONG_FETCH("kern.sgrowsiz", &sgrowsiz); /* - * Let the administrator set {NGROUPS_MAX}, but disallow values - * less than NGROUPS_MAX which would violate POSIX.1-2008 or - * greater than INT_MAX-1 which would result in overflow. + * Let the administrator set {NGROUPS_MAX}. + * + * Values less than NGROUPS_MAX would violate POSIX/SuS (see the + * specification for , paragraph "Runtime Increasable + * Values"). + * + * On the other hand, INT_MAX would result in an overflow for the common + * 'ngroups_max + 1' computation (to obtain the size of the internal + * groups array, its first element being reserved for the effective + * GID). Also, the number of allocated bytes for the group array must + * not overflow on 32-bit machines. For all these reasons, we limit the + * number of supplementary groups to some very high number that we + * expect will never be reached in all practical uses and ensures we + * avoid the problems just exposed, even if 'gid_t' was to be enlarged + * by a magnitude. */ ngroups_max = NGROUPS_MAX; TUNABLE_INT_FETCH("kern.ngroups", &ngroups_max); if (ngroups_max < NGROUPS_MAX) ngroups_max = NGROUPS_MAX; + else { + const int ngroups_max_max = (1 << 24) - 1; + + if (ngroups_max > ngroups_max_max) + ngroups_max = ngroups_max_max; + } /* * Only allow to lower the maximal pid.