git: 4f87ec982528 - stable/13 - net: Validate interface group names in ioctl handlers

The branch stable/13 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=4f87ec9825283e5f3c4eabd31e69acd030236d5e

commit 4f87ec9825283e5f3c4eabd31e69acd030236d5e
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2025-10-27 16:27:13 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2025-10-30 14:09:58 +0000

    net: Validate interface group names in ioctl handlers
    
    The handlers were not checking that the group names are nul-terminated.
    Add checks for this.
    
    Reported by:    Ilja Van Sprundel <ivansprundel@ioactive.com>
    Reviewed by:    zlei
    MFC after:      3 days
    Differential Revision:  https://reviews.freebsd.org/D53344
    
    (cherry picked from commit 32919a34f17ac1af99dec7376f22a8393c251602)
---
 sys/net/if.c | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/sys/net/if.c b/sys/net/if.c
index 46ebabe09a51..c642e99136d8 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -2806,15 +2806,20 @@ ifhwioctl(u_long cmd, struct ifnet *ifp, caddr_t data, struct thread *td)
 		break;
 
 	case SIOCAIFGROUP:
+	{
+		const char *groupname;
+
 		error = priv_check(td, PRIV_NET_ADDIFGROUP);
 		if (error)
 			return (error);
-		error = if_addgroup(ifp,
-		    ((struct ifgroupreq *)data)->ifgr_group);
+		groupname = ((struct ifgroupreq *)data)->ifgr_group;
+		if (strnlen(groupname, IFNAMSIZ) == IFNAMSIZ)
+			return (EINVAL);
+		error = if_addgroup(ifp, groupname);
 		if (error != 0)
 			return (error);
 		break;
-
+	}
 	case SIOCGIFGROUP:
 	{
 		struct epoch_tracker et;
@@ -2826,15 +2831,20 @@ ifhwioctl(u_long cmd, struct ifnet *ifp, caddr_t data, struct thread *td)
 	}
 
 	case SIOCDIFGROUP:
+	{
+		const char *groupname;
+
 		error = priv_check(td, PRIV_NET_DELIFGROUP);
 		if (error)
 			return (error);
-		error = if_delgroup(ifp,
-		    ((struct ifgroupreq *)data)->ifgr_group);
+		groupname = ((struct ifgroupreq *)data)->ifgr_group;
+		if (strnlen(groupname, IFNAMSIZ) == IFNAMSIZ)
+			return (EINVAL);
+		error = if_delgroup(ifp, groupname);
 		if (error != 0)
 			return (error);
 		break;
-
+	}
 	default:
 		error = ENOIOCTL;
 		break;
@@ -2978,9 +2988,17 @@ ifioctl(struct socket *so, u_long cmd, caddr_t data, struct thread *td)
 		goto out_noref;
 
 	case SIOCGIFGMEMB:
-		error = if_getgroupmembers((struct ifgroupreq *)data);
-		goto out_noref;
+	{
+		struct ifgroupreq *req;
 
+		req = (struct ifgroupreq *)data;
+		if (strnlen(req->ifgr_name, IFNAMSIZ) == IFNAMSIZ) {
+			error = EINVAL;
+			goto out_noref;
+		}
+		error = if_getgroupmembers(req);
+		goto out_noref;
+	}
 #if defined(INET) || defined(INET6)
 	case SIOCSVH:
 	case SIOCGVH: