From nobody Fri Mar 20 22:49:51 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fcySJ2dWcz6WBps for ; Fri, 20 Mar 2026 22:49:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fcySJ0Dssz46GF for ; Fri, 20 Mar 2026 22:49:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1774046992; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KeD6ylozXGJZjYT+GMxG4MvUQP14S5Sa8IxXbauJHmA=; b=Nsr232vTf5zotQBt3rHBOtfR7YokZ0qkST8emilAm+qbXTvSngK88xmehnMbSaVsIOKcC8 cRDazgsarFtAVnuN2dkx+AwDfoxWqYfQVomi4rs/YkendTL41UUPLY6kwTPye54EdzT3a5 n+VOdZJcxCBqeSbWOkriChft4Kg2z1BU4KPGkf3quWy7mumwKpXuUqFxxhbBscsiQOlvtJ I9DvaUUGOy3H6tFGk9IqE4nZwJigmZtS4sbsy4sj5s/V/r4BWSqvc6B2Z/h5xYqBRfRswF FqydS3amTorsDFqdI2IShdogHWnVHlsK/zvT5z9nYAn4CVSuY6aNIa3akFrjBA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1774046992; a=rsa-sha256; cv=none; b=dSQSnaZ/9PtlpW0MMHm176sbgaQ4s/9i5hfUrvDzEiHMdK+hZgSvCLBKOWGQiq0YDNIxJ1 pd8+HQntaLZL7KnZ+/J6+023cn13yyA114pX5YL7mMSE+bFVJOiw6xfcndsH0Dp25iichT z955Y/WfBVBLAf9EzrihzJ/CZ/jBgZzyjpZo181UBHbQqjJRKNKcuR9hI43pSos+E8QSsS 0MGrjxgQgYUkxBAR4YIdyRrW6G8O/iOPMCDxo5axJSoohfbWJcDblyKdWpdi9lDsR8sXSU zbYUP3Yp7uwJqDx3cg09B3RJP+MbVBkumxOU1x3vOpgci8hz9iwE5nbvdIg/9w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1774046992; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KeD6ylozXGJZjYT+GMxG4MvUQP14S5Sa8IxXbauJHmA=; b=Vb5BP9UDu9LE6JBr2xXbdQLzNItNkOdVEm9XgpdD1687INXBddZhuiCeRDkJjc3PJbFEAf mVz80JcGnYIICbBxPF9FEeNEDYkG6sjZ14CJVWW94eD8GM9zDUUbQOSBVlTy/RHjMjluoW LEGnLbvJ0T9iO7RR4bpTgo61y8lz5bb4IbvWEPcJRcDZj1rbfVsr7lZk7KYPEmeolEWmjg zcAur0R0YVmXqTMajUjvBhG716FIsRXF8CfymXp7cLyTUCwWVq3xInDlseHNPFqiW1U3Ev 0xTwH65TiKGFDLDah6O1CjFgAYWJKsfbN1/Mpgj0tQwpckl10e4mSYtxeOJhLQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4fcySH6q2Mzm13 for ; Fri, 20 Mar 2026 22:49:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 27522 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 20 Mar 2026 22:49:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Konstantin Belousov Subject: git: 8892176c86db - main - amd64: check that %cs and %ss values from ucontext fit into registers List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8892176c86db18bd175cc00a2d52dff080babec1 Auto-Submitted: auto-generated Date: Fri, 20 Mar 2026 22:49:51 +0000 Message-Id: <69bdcf0f.27522.7376cee9@gitrepo.freebsd.org> The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=8892176c86db18bd175cc00a2d52dff080babec1 commit 8892176c86db18bd175cc00a2d52dff080babec1 Author: Konstantin Belousov AuthorDate: 2026-03-15 07:17:24 +0000 Commit: Konstantin Belousov CommitDate: 2026-03-20 21:05:15 +0000 amd64: check that %cs and %ss values from ucontext fit into registers This change only checks that the values from the user-supplied context are not truncated by C implicit type convertions. The validity of the segment selectors is still checked by hardware. Reviewed by: jhb, markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D55861 --- sys/amd64/amd64/exec_machdep.c | 19 +++++++++++++++++++ sys/amd64/ia32/ia32_signal.c | 28 ++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+) diff --git a/sys/amd64/amd64/exec_machdep.c b/sys/amd64/amd64/exec_machdep.c index b5eda6f83d46..7d567c561c52 100644 --- a/sys/amd64/amd64/exec_machdep.c +++ b/sys/amd64/amd64/exec_machdep.c @@ -94,6 +94,15 @@ _Static_assert(sizeof(mcontext_t) == 800, "mcontext_t size incorrect"); _Static_assert(sizeof(ucontext_t) == 880, "ucontext_t size incorrect"); _Static_assert(sizeof(siginfo_t) == 80, "siginfo_t size incorrect"); +/* + * Check that the value r is 16bit, i.e. fits into a segment register. + */ +static bool +is_seg_val(register_t r) +{ + return ((uint64_t)r <= 0xffff); +} + /* * Send an interrupt to process. * @@ -262,6 +271,14 @@ sys_sigreturn(struct thread *td, struct sigreturn_args *uap) return (EINVAL); } + if (!is_seg_val(ucp->uc_mcontext.mc_ss) || + !is_seg_val(ucp->uc_mcontext.mc_cs)) { + uprintf("pid %d (%s): sigreturn cs = %#lx ss = %#lx\n", + p->p_pid, td->td_name, ucp->uc_mcontext.mc_cs, + ucp->uc_mcontext.mc_ss); + return (EINVAL); + } + /* * Don't allow users to load a valid privileged %cs. Let the * hardware check for invalid selectors, excess privilege in @@ -659,6 +676,8 @@ set_mcontext(struct thread *td, mcontext_t *mcp) if (mcp->mc_len != sizeof(*mcp) || (mcp->mc_flags & ~_MC_FLAG_MASK) != 0) return (EINVAL); + if (!is_seg_val(mcp->mc_ss) || !is_seg_val(mcp->mc_cs)) + return (EINVAL); rflags = (mcp->mc_rflags & PSL_USERCHANGE) | (tp->tf_rflags & ~PSL_USERCHANGE); if (mcp->mc_flags & _MC_HASFPXSTATE) { diff --git a/sys/amd64/ia32/ia32_signal.c b/sys/amd64/ia32/ia32_signal.c index 54e170450dba..3b26244932b4 100644 --- a/sys/amd64/ia32/ia32_signal.c +++ b/sys/amd64/ia32/ia32_signal.c @@ -88,6 +88,15 @@ extern char _binary_elf_vdso32_so_1_size; static void freebsd4_ia32_sendsig(sig_t, ksiginfo_t *, sigset_t *); #endif +/* + * Check that the value r is 16bit, i.e. fits into a segment register. + */ +static bool +is_seg_val(uint32_t r) +{ + return (r <= 0xffff); +} + static void ia32_get_fpcontext(struct thread *td, struct ia32_mcontext *mcp, char **xfpusave, size_t *xfpusave_len) @@ -205,6 +214,8 @@ ia32_set_mcontext(struct thread *td, struct ia32_mcontext *mcp) tp = td->td_frame; if (mcp->mc_len != sizeof(*mcp)) return (EINVAL); + if (!is_seg_val(mcp->mc_ss) || !is_seg_val(mcp->mc_cs)) + return (EINVAL); rflags = (mcp->mc_eflags & PSL_USERCHANGE) | (tp->tf_rflags & ~PSL_USERCHANGE); if (mcp->mc_flags & _MC_IA32_HASFPXSTATE) { @@ -707,6 +718,8 @@ ofreebsd32_sigreturn(struct thread *td, struct ofreebsd32_sigreturn_args *uap) if (!EFL_SECURE(eflags, regs->tf_rflags)) { return (EINVAL); } + if (!is_seg_val(scp->sc_ss) || !is_seg_val(scp->sc_cs)) + return (EINVAL); if (!CS_SECURE(scp->sc_cs)) { ksiginfo_init_trap(&ksi); ksi.ksi_signo = SIGBUS; @@ -772,6 +785,13 @@ freebsd4_freebsd32_sigreturn(struct thread *td, return (EINVAL); } + if (!is_seg_val(ucp->uc_mcontext.mc_ss) || + !is_seg_val(ucp->uc_mcontext.mc_cs)) { + uprintf("pid %d (%s): sigreturn cs = %#x ss = %#x\n", + td->td_proc->p_pid, td->td_name, ucp->uc_mcontext.mc_cs, + ucp->uc_mcontext.mc_ss); + return (EINVAL); + } /* * Don't allow users to load a valid privileged %cs. Let the * hardware check for invalid selectors, excess privilege in @@ -841,6 +861,14 @@ freebsd32_sigreturn(struct thread *td, struct freebsd32_sigreturn_args *uap) return (EINVAL); } + if (!is_seg_val(ucp->uc_mcontext.mc_ss) || + !is_seg_val(ucp->uc_mcontext.mc_cs)) { + uprintf("pid %d (%s): sigreturn cs = %#x ss = %#x\n", + td->td_proc->p_pid, td->td_name, ucp->uc_mcontext.mc_cs, + ucp->uc_mcontext.mc_ss); + return (EINVAL); + } + /* * Don't allow users to load a valid privileged %cs. Let the * hardware check for invalid selectors, excess privilege in