From nobody Sat Nov 30 16:51:24 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Y0wzw4Jv4z5fJ15; Sat, 30 Nov 2024 16:51:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Y0wzw2dvbz4npB; Sat, 30 Nov 2024 16:51:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1732985484; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=trZtUOu60rzAerwl0Za5VbX3JTw+NIqmfrfAP+St1ps=; b=vgWCb4HifHTM750l3+sk+tGX2y7XeSfZIdidn1raQIdbAnxJRMvrNrVDgto/xzYK7BV/48 y6uE+whudUNdivslZNKYlC2f5ImGYbqeWcYOYugY8CCg5iYjXUezA6fGUa0hfBu+wXzS1U UUINFbpyPatrtlz0eugjSG2ZWkrpXYtzUXl+85sgNGRUqiM+FBbCVHp/DtdsUtT1B5l0pK l33K076kRTTtBxyrJHHxDn7IKCW+O3llYi80Sy54SvF+nD0zdwt4J+aWKEv8TNjt6Ukg8D PgPKLzV7Ik4Kl2HSuidkYBgpJSb46MmupNHILbrx+Ll4MJ155vugJWZ7wl9sAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1732985484; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=trZtUOu60rzAerwl0Za5VbX3JTw+NIqmfrfAP+St1ps=; b=GziOvQehAKvw69h4v6F9WuoqB23+Kqgtwjd1NMD1x2u1P23QGsz7o8VZtZ5xUdcVYAy1SN 4w7XISC0udip+tdx7eo3U+pN2vd60uLmFtwc54mGNniUDTaUkyjMSeGlgQyuagEVytgabm ppS3nUV4sEcZhI9OPemz9YKKqFXa1UK8SN+In/F9TeRBroI6pNq8bTvUfnHTFtPnBHAqT8 Z8JPesdGmXmOFCmcj+ldJBqaM+H1WDQGP+dV6WW6w0O47Iu3VuLQshhSjATyhbwvIqMQpD Pf40UxQdpMfuCBEAP+Ei2ehvUnmHbWmFVCl3nGZA3Au1gw2CBEp3BprFDckOAQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1732985484; a=rsa-sha256; cv=none; b=omhADA94lvReNRaLiEd+1ceXhA51GrJIN6OLNN8QRPjugKcgCdplcEYDKBZ+1wW4pUT5Mu KtAiAyJxy9zFwQ+1S7p/BfqJo8tXPNZzTSHz75B1HrhfVTBh5BTyTco9JfsRWL7AevZ2gE TWPQLdRn+b0Q2AXbrteEkexISetNeq4nQ/zE1sIIe0Jh5AJgiqVJDCMrhi06zx/abwrV70 48dWKFj0ZND1jJRkvyR80g2kyeG6Cb5NqytNXGKqO0XCFu7scl9r45QYrq9Jn5pNDPmAUZ 4LkZ4KWpQF7MJlW331FIdufVOo8CggyLTTtTm6lZAkjc4ezs2i3NHJcloptfEw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Y0wzw2FMmzGTJ; Sat, 30 Nov 2024 16:51:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4AUGpObH046499; Sat, 30 Nov 2024 16:51:24 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4AUGpOZe046496; Sat, 30 Nov 2024 16:51:24 GMT (envelope-from git) Date: Sat, 30 Nov 2024 16:51:24 GMT Message-Id: <202411301651.4AUGpOZe046496@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: John Baldwin Subject: git: ec2aaa9c7053 - stable/14 - fwcontrol: Allocate full fw_asyreq structures passed to the kernel List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jhb X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: ec2aaa9c705392c8f419b51aeb6daa12bdaa3435 Auto-Submitted: auto-generated The branch stable/14 has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=ec2aaa9c705392c8f419b51aeb6daa12bdaa3435 commit ec2aaa9c705392c8f419b51aeb6daa12bdaa3435 Author: John Baldwin AuthorDate: 2024-07-19 17:08:14 +0000 Commit: John Baldwin CommitDate: 2024-11-30 13:55:58 +0000 fwcontrol: Allocate full fw_asyreq structures passed to the kernel The FW_ASYREQ ioctl accepts a struct fw_asyreq object as its argument, meaning that the kernel always copies in the full structure in sys_ioctl before passing the request down to the driver. However, fwcontrol was allocating smaller objects that contained only the request header and a variable-sized payload. This means that the kernel copy in sys_ioctl was reading off the end of this buffer. On current architectures this happened to be ok, but it is UB. Instead, allocate a full structure. Reported by: GCC 14 -Walloc-size Reviewed by: rlibby, brooks Differential Revision: https://reviews.freebsd.org/D46014 (cherry picked from commit 9494dfe1b3faf5c48abaa9be4ec87e4669963942) --- usr.sbin/fwcontrol/fwcontrol.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/usr.sbin/fwcontrol/fwcontrol.c b/usr.sbin/fwcontrol/fwcontrol.c index 94478259606d..ce908341a42a 100644 --- a/usr.sbin/fwcontrol/fwcontrol.c +++ b/usr.sbin/fwcontrol/fwcontrol.c @@ -207,7 +207,7 @@ read_write_quad(int fd, struct fw_eui64 eui, u_int32_t addr_lo, int readmode, u_ struct fw_asyreq *asyreq; u_int32_t *qld, res; - asyreq = (struct fw_asyreq *)malloc(sizeof(struct fw_asyreq_t) + 16); + asyreq = malloc(sizeof(*asyreq)); if (asyreq == NULL) err(EX_SOFTWARE, "%s:asyreq malloc", __func__); asyreq->req.len = 16; @@ -262,7 +262,7 @@ send_phy_config(int fd, int root_node, int gap_count) { struct fw_asyreq *asyreq; - asyreq = (struct fw_asyreq *)malloc(sizeof(struct fw_asyreq_t) + 12); + asyreq = malloc(sizeof(*asyreq)); if (asyreq == NULL) err(EX_SOFTWARE, "%s:asyreq malloc", __func__); asyreq->req.len = 12; @@ -289,7 +289,7 @@ link_on(int fd, int node) { struct fw_asyreq *asyreq; - asyreq = (struct fw_asyreq *)malloc(sizeof(struct fw_asyreq_t) + 12); + asyreq = malloc(sizeof(*asyreq)); if (asyreq == NULL) err(EX_SOFTWARE, "%s:asyreq malloc", __func__); asyreq->req.len = 12; @@ -308,7 +308,7 @@ reset_start(int fd, int node) { struct fw_asyreq *asyreq; - asyreq = (struct fw_asyreq *)malloc(sizeof(struct fw_asyreq_t) + 16); + asyreq = malloc(sizeof(*asyreq)); if (asyreq == NULL) err(EX_SOFTWARE, "%s:asyreq malloc", __func__); asyreq->req.len = 16;