From nobody Mon Jun 29 19:26:07 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8c342yz6jjd2 for ; Mon, 29 Jun 2026 19:26:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8b617Yz40kP for ; Mon, 29 Jun 2026 19:26:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761167; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ynU2r0utBiL8AR89b5mUEl++SDYI+VtFZ2C6ZBrlE9I=; b=P8lajltGiLTOf1dwmD57HNr8sBIE5lxT7/FduIF+zToRc/jRWr584qTCnSUBcgdl5fPf0o 19LVB0bHnb9ebhkLvLmNGQFlM9gqSWgY9JEImbKcVwkSK4qqox9dSdfidGX7D92VIH1qbo ztUnauHKhB/N3Bz1lnMey3RUkXrBEyvhGlAsmdOlgT7aZuu/Z98pnjPXAW1/gciHUxJ4m7 9RD3kLilWPW5jDQ2PH8S6DiMubPLkosVOrT3tq+hWcFYAZ4OTgnbcdLMpHYvZOsOG5f5fQ ZeCHttm5kiTQiC0O2O6JFrYn9zYyLGLZgfsdGuxJLSiDMiv4V0/H7ldUqMR7sA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761167; a=rsa-sha256; cv=none; b=FOjhL4ReGfKQrEDur6EvVZbM3xQlhrzLSnQt97+SADh28Xee2/PLyTE7/pOk71cD0Wc8xq pxJCJvZ1pFwy5hXFujwaqx3xtlhPNQYz9KGjI5Eqy8YmXnJIzf8GxJ7ZgY7Oj6jllI6fxX 8XmJDiAqV2PuFTv6JPonjPe+9lrw5f99pGxK5iU2ZxC6J8qmnoej8po2ruswTtMIO/0QQK qKO9PGAsP94N6Y69TFS6wHJ7AbQQUI9J0Wmk39Bf8mcc3VMSDrjniFcAK1Ly7bSbOzdEQV j530HVsEgS+iYXCslzj33UL/J/COFXaRrbFcmG8gxlU/7N+LWr/mpmyU3yppYA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761167; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ynU2r0utBiL8AR89b5mUEl++SDYI+VtFZ2C6ZBrlE9I=; b=xASISQtU6hu1vGV2/GKKIt5HGjUO75Bg1jcUQwrZpUqpw3jJd/t9ZFGNTF3QJNf8MkLqvD WznPVUtzr9YAIJxYdncj2wiTBnDnIQiYbUB0CMA+9Ik4hktXkCFoKaXfbT60gZAlg2Ji3A KO2kjK7vrefgPtsdA5Hy9xo6ekIkwooFJu96EzOW5g8yDWgwsEgFe5YifvxfYKp8912X9v lXC8EqGt8gQSOggGRsS876sqHyojag0KXxBQsaStQaMMTxQeSuWBEh6gV5HRWBfS+kV1aU IN37NBu0TsWw9aMtK7zq5D5fdFBru9/C8TbuNJAoiB1dQmc7ty5Re2qMX394Yw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8b4w8Qz196q for ; Mon, 29 Jun 2026 19:26:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1fe68 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:26:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 9dea58fb0fc0 - stable/15 - MAC/do: Fix double-free on parse error after "executable paths" feature List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 9dea58fb0fc016644c72c4787cbf7fadbcaa1ba3 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:26:07 +0000 Message-Id: <6a42c6cf.1fe68.11cb437f@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=9dea58fb0fc016644c72c4787cbf7fadbcaa1ba3 commit 9dea58fb0fc016644c72c4787cbf7fadbcaa1ba3 Author: Olivier Certner AuthorDate: 2026-06-01 08:52:16 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:57 +0000 MAC/do: Fix double-free on parse error after "executable paths" feature parse_rules() has been calling toast_rules() in case of a parse error in order to deallocate the 'struct rule' objects it has constructed up to that point. toast_rules() would take a pointer to a full 'struct rules' object, and besides freeing all 'struct rule' referenced by it, would also free the holding 'struct rules' itself. With the introduction of the "executable paths" feature, and the embedding of 'struct rules' into 'struct conf', meaning that the lifecycle for 'struct rules' was no longer independent, toast_rules() was changed not to free the passed 'struct rules' (as it was a field of a 'struct conf' object). Unfortunately, this change was not completed with a reinitialization of the rules list head, so the 'struct conf' object would continue to reference just-freed rules, which then would be freed a second time on destruction of that container. So, make toast_rules() re-initialize the rules list in 'struct rules', which it logically has been having to do since not freeing the enclosing 'struct rules'. This alone is enough to fix the bug, but let's use the occasion to change the contract of parse_rules() and bring its herald comment up-to-date: On error, parse_rules() now simply leaves already constructed 'struct rule' objects in 'conf'. The latter is eventually destroyed and the rule objects reclaimed at that point. Add a test trying to set an invalid rules configuration with the first rule being valid and the second being invalid, which triggers the bug (and an immediate panic() on an INVARIANTS kernel). Reported by: impost0r(ret2plt) Reviewed by: markj Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") Sponsored by: The FreeBSD Foundation (cherry picked from commit 79d0dbc9c6d6a1627c9f3eeab0633c232a6a0a34) --- sys/security/mac_do/mac_do.c | 16 ++++++++-------- tests/sys/mac/do/invalid_configs.sh | 14 ++++++++++++++ 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index d807ea7ddd7d..d150c8bcb228 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -392,6 +392,7 @@ toast_rules(struct rules *const rules) free(rule->gids, M_MAC_DO); free(rule, M_MAC_DO); } + STAILQ_INIT(head); } static inline void @@ -1073,13 +1074,13 @@ einval: /* * Parse rules specification and produce rule structures out of it. * - * Must be called with '*parse_error' set to NULL. Returns 0 on success, with - * '*rulesp' made to point to a 'struct rule' representing the rules. On error, - * the returned value is non-zero and '*rulesp' is unchanged. If 'string' has - * length greater or equal to MAX_RULE_STRING_SIZE, ENAMETOOLONG is returned. If - * it is not in the expected format, EINVAL is returned. If an error is - * returned, '*parse_error' is set to point to a 'struct parse_error' giving an - * error message for the problem. + * Must be called with '*parse_error' set to NULL. Returns 0 on success, + * filling the passed '*rules' with 'struct rule' objects. On error, the + * returned value is non-zero, and '*rules' may have been changed. If 'string' + * has length greater or equal to MAX_RULE_STRING_SIZE, ENAMETOOLONG is + * returned. If it is not in the expected format, EINVAL is returned. If an + * error is returned, '*parse_error' is set to point to a 'struct parse_error' + * giving an error message for the problem. * * Expected format: A >-colon-separated list of rules of the form * ">" (for backwards compatibility, a semi-colon ":" is accepted @@ -1125,7 +1126,6 @@ parse_rules(const char *const string, struct rules *const rules, error = parse_single_rule(rule, rules, parse_error); if (error != 0) { (*parse_error)->pos += rule - copy; - toast_rules(rules); goto error; } } diff --git a/tests/sys/mac/do/invalid_configs.sh b/tests/sys/mac/do/invalid_configs.sh index d1a9eb8c1e96..91e38a0055c0 100644 --- a/tests/sys/mac/do/invalid_configs.sh +++ b/tests/sys/mac/do/invalid_configs.sh @@ -72,6 +72,19 @@ rules_wrong_separator_body() sysctl_set_and_check_fails_rules "uid=1001>gid=0:gid=1001>gid=5" } +# Added after observing a panic() in this situation because of a double-free +# after introduction of "exec_paths". +atf_test_case non_first_rule_unparseable +non_first_rule_unparseable_head() +{ + atf_set descr "Non-first rule wrong" +} + +non_first_rule_unparseable_body() +{ + sysctl_set_and_check_fails_rules "gid=1001>uid=0;hello" +} + atf_init_test_cases() { @@ -83,4 +96,5 @@ atf_init_test_cases() atf_add_test_case rule_user_names_fail atf_add_test_case rule_group_names_fail atf_add_test_case rules_wrong_separator + atf_add_test_case non_first_rule_unparseable }