From nobody Wed Sep 16 15:35:09 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hlNHf2sVhz6rfVn for ; Wed, 16 Sep 2026 15:35:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hlNHd6B2sz4h0w for ; Wed, 16 Sep 2026 15:35:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789572910; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jq6OeUDA0vN6BxB7s1aj2UuHvIvNcvDJNY0ciKX4ejk=; b=ag7Ys9rcvLm2YK5NM3sTAWhPrcukFcAYt+3XA55Bmmvst+lPA/KLo6upr+4ZUL75RlM4tX kszuEA33iB2f32wrg3K4KttJgw4ljSsvkQiyXulnRcwmyVASLIGW+4pgtY3nl4OESkx16a sZyL9kI4jlRkKq2Bp0pohebiLIQ020PffcCyAH/S+JCnjNINS1GXI3t+pcsCte9t8BGXQD j2y1GrMFJtX+MhUyW/DKXT4rJa6/gpif130ZaUgM/H/60pRaEyXn2gcOwk4TgTqiNF65RV sumVUxEEKgREAUAEO1Xh/3P2fh12719cGHIknIYHPdO4ViR4nI0E05vGse2JLQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1789572909; b=eD3TFSX9kxspqj1SDE6X0jM6uu5QXGPaWZcvqKBS+NTnNdb9QNViahju2iIX7D9xXaLeCx BeE8fN1FCvFIAxvMzOTi2illgs5tehNmHhDsNz1+/TFUS6B1K0TldAQWC/ycLWIdFoFF4k uN1hUxJsi8C6RBudKHMhKHvzI6+cmyoCZXIdJ7x4E3h1mkgaWA8mJlT7bPtltzYKVZFST4 Dt73nLV0Xo1nRDO6hVXtmHSM6OFPgEo/y4woR0QJzSxKUBBizFqPor8cse80PnQecfTp4T oVt4WrKWl8Ss2OHCqp4+lNQuKsd5wj5uLYl3evwsZje+M1c7mkcDcz2TBNt5BA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789572909; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jq6OeUDA0vN6BxB7s1aj2UuHvIvNcvDJNY0ciKX4ejk=; b=PXgrUcF4nM6ASDpQbbxuEkBrO6rLBvqkfcwNkUcekReml0+cw8WdzdBI1zFVc0tkMbiz/s uBV2C1sPvUxyGbMcmSvIVKtQdGtQ5LVFgYQ4C/Icdxywfdgcwgg8QAi8820dhrAWcOpynJ 8iPQD6/PbYnwKgl5domhviMG3zv56xNfFgyChbjLwiO2i/X3hU/1f9owgFZWnTwKsZg7b6 hshEfwOQqt32s1UtQMC7yXJ1BBCMtVlvxDSjyCwUwfP18NzZqWbPZwUYHmiTSQac/saTDJ nl15rMkU3pTznEfVcdnh2VxLijIaT8njldxxRXoR9DdWzoBoZSSUD7k4ObHQlA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hlNHd5DvmzsM0 for ; Wed, 16 Sep 2026 15:35:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3ef2e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 16 Sep 2026 15:35:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Andrew Griffiths From: Mark Johnston Subject: git: 5d0b87669a91 - main - mac_bsdextended: reject negative rule indices in sysctl_rule() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 5d0b87669a91244e330a35fc973e6c60f92f6d1f Auto-Submitted: auto-generated Date: Wed, 16 Sep 2026 15:35:09 +0000 Message-Id: <6aaab72d.3ef2e.7f780cf3@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=5d0b87669a91244e330a35fc973e6c60f92f6d1f commit 5d0b87669a91244e330a35fc973e6c60f92f6d1f Author: Andrew Griffiths AuthorDate: 2026-09-16 13:04:46 +0000 Commit: Mark Johnston CommitDate: 2026-09-16 15:34:31 +0000 mac_bsdextended: reject negative rule indices in sysctl_rule() The security.mac.bsdextended.rules. node handler takes N as `index = name[0]` (a signed int) and only checks `index >= MAC_BSDEXTENDED_MAXRULES`. A negative index is caught on the read branch, but the write-only add and delete branches proceed to `rules[index]` unconditionally. Reject `index < 0` alongside the existing upper-bound check. Submitted by calif.io for the OpenAI Patch The Planet program Signed-off-by: Andrew Griffiths Reviewed by: markj MFC after: 2 weeks --- sys/security/mac_bsdextended/mac_bsdextended.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/security/mac_bsdextended/mac_bsdextended.c b/sys/security/mac_bsdextended/mac_bsdextended.c index bf95c008e2f2..5047a723fe01 100644 --- a/sys/security/mac_bsdextended/mac_bsdextended.c +++ b/sys/security/mac_bsdextended/mac_bsdextended.c @@ -143,7 +143,7 @@ sysctl_rule(SYSCTL_HANDLER_ARGS) if (namelen != 1) return (EINVAL); index = name[0]; - if (index >= MAC_BSDEXTENDED_MAXRULES) + if (index < 0 || index >= MAC_BSDEXTENDED_MAXRULES) return (ENOENT); ruleptr = NULL; @@ -157,7 +157,7 @@ sysctl_rule(SYSCTL_HANDLER_ARGS) mtx_lock(&ugidfw_mtx); if (req->oldptr) { - if (index < 0 || index > rule_slots + 1) { + if (index > rule_slots + 1) { error = ENOENT; goto out; }