From nobody Wed Oct 14 16:04:31 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j4bcc1qqnz6vmhZ for ; Wed, 14 Oct 2026 16:04:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j4bcb4q0kz4bpC for ; Wed, 14 Oct 2026 16:04:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993871; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BuLWJ5ltFvU/edd0vLl14PcVbH7xoFv5jB9q9vKLv8s=; b=ofyfcSVANoqQk7tpCNjBREsk1/dPkA97i91Mtf5I+cH50DXXNuPyea5k6nDDEY/HQrJ+vU 2XICe4RT7fT7qn0Lyo41oyPtC/XQepeIfXOrhZl30+H1vcgm85mUBgos57qRv+avpk6UHL iPfq8CObkPr4BR8eHYC7o457pFdzXzzrpudkzzuNitIRJVw+q1g/Tws5V05ZyoriVGn5F9 yn88dRRhgPO+zQYnjTAogRY9f/Lg1Gn7fDVxOHuHhbbnUf8NRU7J7b9JR+jJgtXyJMxKyJ dpETxDiy715Azm9ntGS2tPjH6UMC9i1bhGn+Cf+E04ze9OmK6RvvnBp9Jt6oiA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791993871; b=Zhsaqdu3uUDaV0CR/qPt9UFmNnaJTzLvsKOT8LV+ddcwEfHO22DGYKi4i5iywCT8GnqRuQ vHlye/oLBeMtQwp3U+lFcRrbXEo42lKXc2Qk6NmCiyk2p5Oe4FCuaS3sOV6YpcNi245gg5 F/WzLnen74hXht/JWp33m8vzeGP5GYDv20HYTfpSdJ80OUmi0chjOzDnRmv99fL6YLaew4 kWbRdrpcOOktoGUpMA7dyD9pJwrAZdHFcfir8z3D5IfEvVfG7gxKAaAcA8VntSzcawV/ou 6upfIGI7k12IW6MrtNbEq/cIXDIKZahdf3BDMezQ19qzDYaT9HHRemVrw2bGBA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993871; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BuLWJ5ltFvU/edd0vLl14PcVbH7xoFv5jB9q9vKLv8s=; b=qZDBHj1vQN54jheNDHo/C4Hcdzn5eX8gE9MIJTDbG4GPcEwpaY9JFz/mW6gt6vkflLniwZ 7JdMOTEYZOLEsgbbcm95cjGJipenHPdaFa4fi1yj4AtZ9wKo08JGeUywfTUdRbFi2m4Lva iQLDySHt7KRDki/iN4g9vWfDcUbhABCPLlgGUz7g4pxJFQunmAVNgZ1bYuUInfYHdmlgVd KG/SzX2RD49MlFuYlb2mHJUgLXVo5PJThsAvpTC4XfOxwcPaykOYuo5xOoK7vAK4of7MjK d8bBXKQi3JTuneWtICTavEu32Yfs/ic5H8LDH8IxflkO9yakPL0bLeJQUEhQmg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j4bcb3trrz18Fj for ; Wed, 14 Oct 2026 16:04:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 30336 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 14 Oct 2026 16:04:31 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav From: Mark Johnston Subject: git: b5839f51f80a - releng/15.1 - hastd: Ensure nvpair padding is initialized List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: b5839f51f80adf341af52cd8c860c4e6d6aaa12a Auto-Submitted: auto-generated Date: Wed, 14 Oct 2026 16:04:31 +0000 Message-Id: <6acfa80f.30336.2cd3d7f@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b5839f51f80adf341af52cd8c860c4e6d6aaa12a commit b5839f51f80adf341af52cd8c860c4e6d6aaa12a Author: Dag-Erling Smørgrav AuthorDate: 2026-09-05 15:44:05 +0000 Commit: Mark Johnston CommitDate: 2026-10-13 14:10:21 +0000 hastd: Ensure nvpair padding is initialized The proto-libnv implementation embedded in hastd pads names and values out to the nearest multiple of eight bytes, but leaves the padding uninitialized, leaking up to 14 bytes of recycled heap per pair in a message. While here, switch from bcopy() to memcpy(). Approved by: so Security: FreeBSD-EN-26:26.hastd MFC after: 3 days Reviewed by: kevans, emaste Differential Revision: https://reviews.freebsd.org/D59343 (cherry picked from commit 911bda7cffbf358c4e83ea05cfe980d429aff61c) (cherry picked from commit 0d0f40cd29d2aba7bfeef8861b73930bbb84308e) --- sbin/hastd/nv.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sbin/hastd/nv.c b/sbin/hastd/nv.c index 16ab95cf0dc6..87d59c6929b9 100644 --- a/sbin/hastd/nv.c +++ b/sbin/hastd/nv.c @@ -500,7 +500,7 @@ nv_get_##type(struct nv *nv, const char *namefmt, ...) \ return (0); \ PJDLOG_ASSERT((nvh->nvh_type & NV_ORDER_MASK) == NV_ORDER_HOST);\ PJDLOG_ASSERT(sizeof(value) == nvh->nvh_dsize); \ - bcopy(NVH_DATA(nvh), &value, sizeof(value)); \ + memcpy(&value, NVH_DATA(nvh), sizeof(value)); \ \ return (value); \ } @@ -767,7 +767,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type, namesize = strlen(name) + 1; - nvh = malloc(sizeof(*nvh) + roundup2(namesize, 8)); + nvh = calloc(1, sizeof(*nvh) + roundup2(namesize, 8)); if (nvh == NULL) { if (nv->nv_error == 0) nv->nv_error = ENOMEM; @@ -776,7 +776,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type, nvh->nvh_type = NV_ORDER_HOST | type; nvh->nvh_namesize = (uint8_t)namesize; nvh->nvh_dsize = (uint32_t)vsize; - bcopy(name, nvh->nvh_name, namesize); + memcpy(nvh->nvh_name, name, namesize); /* Add header first. */ if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) == -1) {