From nobody Thu Feb 13 16:53:18 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Yv1TW1kLkz5myY0; Thu, 13 Feb 2025 16:53:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Yv1TV5BvFz3TJV; Thu, 13 Feb 2025 16:53:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1739465598; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RElZc2OO8Mv1IrbcB1qhxlRvyIxkqzDPJ0CNaXOeH3c=; b=NRypvJ9UCyTQkVK3ltKOArEeMkZCmIKFMNjpDdJu3W7CQia8p6KnJQIsAZMcXrqAWpROZQ LarDrorxXwqeBB9BfS2iBBUZJzcn3y1Z97Xn24+4+GZtijNxJNTOJDIf+aRStWX5HLXxtS 8ZbkDsy75rAzqO/mamNjsFleGptFVSVJTJrFtP4T5M+9HAGhkxjow0H0HnTaJvKLSNeIf5 xq9A8vpmQAbuzWh1+Gq0nSdgC3JPAGVJ/faBS4nJRnze0t/xUtyvPvTH6fG0Y4nSmfnJ6P JAQ1r818HVzTOB2Q8gtgQunP12++cKPkAmejVKE8SO/JIXNZ24v2qus0ZrS20g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1739465598; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RElZc2OO8Mv1IrbcB1qhxlRvyIxkqzDPJ0CNaXOeH3c=; b=pP89KhAp76H0GdHovvHEcR7pOSkvoUTAScfezelNHDwENnR7m2qXSnJ9tGny0Rfe4IFuGx j2KNiZuvYdGkT8zUPyLagl+iWfwBGfw6uoLI9f5nWWfklb9VCkt50Q7w5YzqyhvLkEdc8W JQoLo5M5hzC+ixizlAMEwO0F/odhEfwKO2ilBO7RvZrFT3kKDZOrPGwYOLdoqOs+/uxtR0 JcCDKwU6ybjl8tTWaei3t7txyb4yiVytXL6MlS4qOT/mSVaCJUNidkN4BTXBKPHcmfGoO+ GEyEfivzwJJoVIlcwWQjlSu4QwSTslYn56zsO1T1geJTqP5z0yBE/M/Dtlie+Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1739465598; a=rsa-sha256; cv=none; b=Lzfa6/mfnVqCpzfk6Fxq6JQG0vxZiPSKdUeXFDD7IbKJvQYngFAEaWvVI7gZRcKGJJ1GRr cDXtKM1df59kybxZmt4irlMSNmlBgjHoIeo9lprJOPZNjHPsK5jeMa3J2MNIXRSCcdFyAS xO/Jtm7Ku/RQLk6xQSzVPTYJb1df03rK/6h7InQ3T5/w90o+CBDwnU4iqm+UMsKVS7Rzut OCZjYBqmIwpc8T09ZCd/Kw7klk/IMCDjEbWPygTHAEiHCsWpuEvX6+sgu34qBQ3ejwAi0d j9E0GYboLSOaCFqJK9iHZvSvTH4YxjxGuy3zgNrwDup6gRNT2qmFa280/oVG9Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Yv1TV4kfyztFt; Thu, 13 Feb 2025 16:53:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 51DGrIwl059061; Thu, 13 Feb 2025 16:53:18 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 51DGrILH059058; Thu, 13 Feb 2025 16:53:18 GMT (envelope-from git) Date: Thu, 13 Feb 2025 16:53:18 GMT Message-Id: <202502131653.51DGrILH059058@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Zhenlei Huang Subject: git: 6b0086795db0 - releng/13.5 - sysctl: Harden sysctl_handle_string() against unterminated string List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: zlei X-Git-Repository: src X-Git-Refname: refs/heads/releng/13.5 X-Git-Reftype: branch X-Git-Commit: 6b0086795db023796af570dccaa942a3071899b6 Auto-Submitted: auto-generated The branch releng/13.5 has been updated by zlei: URL: https://cgit.FreeBSD.org/src/commit/?id=6b0086795db023796af570dccaa942a3071899b6 commit 6b0086795db023796af570dccaa942a3071899b6 Author: Zhenlei Huang AuthorDate: 2025-02-09 17:17:11 +0000 Commit: Zhenlei Huang CommitDate: 2025-02-13 16:52:50 +0000 sysctl: Harden sysctl_handle_string() against unterminated string In case a variable string which is not null-terminated is passed in, strlen() may report a length exceeding the max length, hence it is possible to leak a portion of kernel memory to the userland. Harden that by using strnlen() to limit the length to the max length. While here, refactor the code a little to improve readability. Note that, when calculating the out length, the null terminator '\0' of the string is taken into account if available. This is not really necessary but userland applications may have already relied on this behavior. Reviewed by: avg, kib, olce Approved by: re (cperciva) Fixes: 210176ad76ee sysctl(9): add CTLFLAG_NEEDGIANT flag MFC after: 4 days Differential Revision: https://reviews.freebsd.org/D48881 (cherry picked from commit 1951235537fb62150f1bb15dd7e170ac30853d35) (cherry picked from commit 8ca77f9f9ece9d89161d080eee6a1aa706001878) (cherry picked from commit dcd7286d902774428c08b179a72bfdcd4556ec06) --- sys/kern/kern_sysctl.c | 42 ++++++++++++++++++++---------------------- 1 file changed, 20 insertions(+), 22 deletions(-) diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c index 371d521d8850..7a4feada157e 100644 --- a/sys/kern/kern_sysctl.c +++ b/sys/kern/kern_sysctl.c @@ -1787,8 +1787,7 @@ int sysctl_handle_string(SYSCTL_HANDLER_ARGS) { char *tmparg; - size_t outlen; - int error = 0, ro_string = 0; + int error = 0; /* * If the sysctl isn't writable and isn't a preallocated tunable that @@ -1800,33 +1799,32 @@ sysctl_handle_string(SYSCTL_HANDLER_ARGS) */ if ((oidp->oid_kind & (CTLFLAG_WR | CTLFLAG_TUN)) == 0 || arg2 == 0 || kdb_active) { - arg2 = strlen((char *)arg1) + 1; - ro_string = 1; - } + size_t outlen; - if (req->oldptr != NULL) { - if (ro_string) { - tmparg = arg1; - outlen = strlen(tmparg) + 1; - } else { + if (arg2 == 0) + outlen = arg2 = strlen(arg1) + 1; + else + outlen = strnlen(arg1, arg2 - 1) + 1; + + tmparg = req->oldptr != NULL ? arg1 : NULL; + error = SYSCTL_OUT(req, tmparg, outlen); + } else { + size_t outlen; + + if (req->oldptr != NULL) { tmparg = malloc(arg2, M_SYSCTLTMP, M_WAITOK); sx_slock(&sysctlstringlock); memcpy(tmparg, arg1, arg2); sx_sunlock(&sysctlstringlock); - outlen = strlen(tmparg) + 1; - } - - error = SYSCTL_OUT(req, tmparg, outlen); - - if (!ro_string) - free(tmparg, M_SYSCTLTMP); - } else { - if (!ro_string) + outlen = strnlen(tmparg, arg2 - 1) + 1; + } else { + tmparg = NULL; sx_slock(&sysctlstringlock); - outlen = strlen((char *)arg1) + 1; - if (!ro_string) + outlen = strnlen(arg1, arg2 - 1) + 1; sx_sunlock(&sysctlstringlock); - error = SYSCTL_OUT(req, NULL, outlen); + } + error = SYSCTL_OUT(req, tmparg, outlen); + free(tmparg, M_SYSCTLTMP); } if (error || !req->newptr) return (error);