Author: delphij
Date: Tue Jun 3 19:03:11 2014
New Revision: 267018
URL: http://svnweb.freebsd.org/changeset/base/267018
Log:
Fix sendmail improper close-on-exec flag handling. [SA-14:11]
Fix ktrace memory disclosure. [SA-14:12]
Fix incorrect error handling in PAM policy parser. [SA-14:13]
Fix triple-fault when executing from a threaded process. [EN-14:06]
Approved by: so
Modified:
releng/9.1/UPDATING
releng/9.1/contrib/sendmail/src/conf.c
releng/9.1/sys/conf/newvers.sh
releng/9.1/sys/kern/kern_exec.c
releng/9.1/sys/kern/kern_ktrace.c
releng/9.1/sys/sys/proc.h
releng/9.1/sys/vm/vm_map.c
releng/9.2/UPDATING
releng/9.2/contrib/openpam/lib/openpam_configure.c
releng/9.2/contrib/sendmail/src/conf.c
releng/9.2/sys/conf/newvers.sh
releng/9.2/sys/kern/kern_exec.c
releng/9.2/sys/kern/kern_ktrace.c
releng/9.2/sys/sys/proc.h
releng/9.2/sys/vm/vm_map.c
Modified: releng/9.1/UPDATING
==============================================================================
--- releng/9.1/UPDATING Tue Jun 3 19:02:52 2014 (r267017)
+++ releng/9.1/UPDATING Tue Jun 3 19:03:11 2014 (r267018)
@@ -9,6 +9,20 @@ handbook.
Items affecting the ports and packages system can be found in
/usr/ports/UPDATING. Please read that file before running portupgrade.
+20140603: p14 FreeBSD-SA-14:11.sendmail
+ FreeBSD-SA-14:12.ktrace
+ FreeBSD-SA-14:13.pam
+ FreeBSD-EN-14:06.exec
+
+ Fix sendmail improper close-on-exec flag handling. [SA-14:11]
+
+ Fix ktrace memory disclosure. [SA-14:12]
+
+ Fix incorrect error handling in PAM policy parser. [SA-14:13]
+
+ Fix triple-fault when executing from a threaded process.
+ [EN-14:06]
+
20140513: p13 FreeBSD-EN-14:03.pkg
FreeBSD-EN-14:04.kldxref
FreeBSD-EN-14:05.ciss
Modified: releng/9.1/contrib/sendmail/src/conf.c
==============================================================================
--- releng/9.1/contrib/sendmail/src/conf.c Tue Jun 3 19:02:52 2014
(r267017)
+++ releng/9.1/contrib/sendmail/src/conf.c Tue Jun 3 19:03:11 2014
(r267018)
@@ -5256,8 +5256,8 @@ closefd_walk(lowest, fd)
*/
void
-sm_close_on_exec(highest, lowest)
- int highest, lowest;
+sm_close_on_exec(lowest, highest)
+ int lowest, highest;
{
#if HASFDWALK
(void) fdwalk(closefd_walk, &lowest);
Modified: releng/9.1/sys/conf/newvers.sh
==============================================================================
--- releng/9.1/sys/conf/newvers.sh Tue Jun 3 19:02:52 2014
(r267017)
+++ releng/9.1/sys/conf/newvers.sh Tue Jun 3 19:03:11 2014
(r267018)
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="9.1"
-BRANCH="RELEASE-p13"
+BRANCH="RELEASE-p14"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
Modified: releng/9.1/sys/kern/kern_exec.c
==============================================================================
--- releng/9.1/sys/kern/kern_exec.c Tue Jun 3 19:02:52 2014
(r267017)
+++ releng/9.1/sys/kern/kern_exec.c Tue Jun 3 19:03:11 2014
(r267018)
@@ -280,6 +280,7 @@ kern_execve(td, args, mac_p)
struct mac *mac_p;
{
struct proc *p = td->td_proc;
+ struct vmspace *oldvmspace;
int error;
AUDIT_ARG_ARGV(args->begin_argv, args->argc,
@@ -296,6 +297,8 @@ kern_execve(td, args, mac_p)
PROC_UNLOCK(p);
}
+ KASSERT((td->td_pflags & TDP_EXECVMSPC) == 0, ("nested execve"));
+ oldvmspace = td->td_proc->p_vmspace;
error = do_execve(td, args, mac_p);
if (p->p_flag & P_HADTHREADS) {
@@ -310,6 +313,12 @@ kern_execve(td, args, mac_p)
thread_single_end();
PROC_UNLOCK(p);
}
+ if ((td->td_pflags & TDP_EXECVMSPC) != 0) {
+ KASSERT(td->td_proc->p_vmspace != oldvmspace,
+ ("oldvmspace still used"));
+ vmspace_free(oldvmspace);
+ td->td_pflags &= ~TDP_EXECVMSPC;
+ }
return (error);
}
Modified: releng/9.1/sys/kern/kern_ktrace.c
==============================================================================
--- releng/9.1/sys/kern/kern_ktrace.c Tue Jun 3 19:02:52 2014
(r267017)
+++ releng/9.1/sys/kern/kern_ktrace.c Tue Jun 3 19:03:11 2014
(r267018)
@@ -119,6 +119,7 @@ static int data_lengths[] = {
0, /* KTR_SYSCTL */
sizeof(struct ktr_proc_ctor), /* KTR_PROCCTOR */
0, /* KTR_PROCDTOR */
+ 0, /* unused */
sizeof(struct ktr_fault), /* KTR_FAULT */
sizeof(struct ktr_faultend), /* KTR_FAULTEND */
};
Modified: releng/9.1/sys/sys/proc.h
==============================================================================
--- releng/9.1/sys/sys/proc.h Tue Jun 3 19:02:52 2014 (r267017)
+++ releng/9.1/sys/sys/proc.h Tue Jun 3 19:03:11 2014 (r267018)
@@ -968,4 +968,5 @@ curthread_pflags_restore(int save)
#endif /* _KERNEL */
+#define TDP_EXECVMSPC 0x40000000 /* Execve destroyed old vmspace */
#endif /* !_SYS_PROC_H_ */
Modified: releng/9.1/sys/vm/vm_map.c
==============================================================================
--- releng/9.1/sys/vm/vm_map.c Tue Jun 3 19:02:52 2014 (r267017)
+++ releng/9.1/sys/vm/vm_map.c Tue Jun 3 19:03:11 2014 (r267018)
@@ -3631,6 +3631,8 @@ vmspace_exec(struct proc *p, vm_offset_t
struct vmspace *oldvmspace = p->p_vmspace;
struct vmspace *newvmspace;
+ KASSERT((curthread->td_pflags & TDP_EXECVMSPC) == 0,
+ ("vmspace_exec recursed"));
newvmspace = vmspace_alloc(minuser, maxuser);
if (newvmspace == NULL)
return (ENOMEM);
@@ -3647,7 +3649,7 @@ vmspace_exec(struct proc *p, vm_offset_t
PROC_VMSPACE_UNLOCK(p);
if (p == curthread->td_proc)
pmap_activate(curthread);
- vmspace_free(oldvmspace);
+ curthread->td_pflags |= TDP_EXECVMSPC;
return (0);
}
Modified: releng/9.2/UPDATING
==============================================================================
--- releng/9.2/UPDATING Tue Jun 3 19:02:52 2014 (r267017)
+++ releng/9.2/UPDATING Tue Jun 3 19:03:11 2014 (r267018)
@@ -11,6 +11,20 @@ handbook:
Items affecting the ports and packages system can be found in
/usr/ports/UPDATING. Please read that file before running portupgrade.
+20140603: p7 FreeBSD-SA-14:11.sendmail
+ FreeBSD-SA-14:12.ktrace
+ FreeBSD-SA-14:13.pam
+ FreeBSD-EN-14:06.exec
+
+ Fix sendmail improper close-on-exec flag handling. [SA-14:11]
+
+ Fix ktrace memory disclosure. [SA-14:12]
+
+ Fix incorrect error handling in PAM policy parser. [SA-14:13]
+
+ Fix triple-fault when executing from a threaded process.
+ [EN-14:06]
+
20140513: p6 FreeBSD-EN-14:03.pkg
FreeBSD-EN-14:04.kldxref
FreeBSD-EN-14:05.ciss
Modified: releng/9.2/contrib/openpam/lib/openpam_configure.c
==============================================================================
--- releng/9.2/contrib/openpam/lib/openpam_configure.c Tue Jun 3 19:02:52
2014 (r267017)
+++ releng/9.2/contrib/openpam/lib/openpam_configure.c Tue Jun 3 19:03:11
2014 (r267018)
@@ -1,6 +1,6 @@
/*-
* Copyright (c) 2001-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2012 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2014 Dag-Erling Smørgrav
* All rights reserved.
*
* This software was developed for the FreeBSD Project by ThinkSec AS and
@@ -194,6 +194,7 @@ openpam_parse_chain(pam_handle_t *pamh,
openpam_log(PAM_LOG_ERROR,
"%s(%d): missing or invalid facility",
filename, lineno);
+ errno = EINVAL;
goto fail;
}
if (facility != fclt && facility != PAM_FACILITY_ANY) {
@@ -209,18 +210,28 @@ openpam_parse_chain(pam_handle_t *pamh,
openpam_log(PAM_LOG_ERROR,
"%s(%d): missing or invalid service name",
filename, lineno);
+ errno = EINVAL;
goto fail;
}
if (wordv[i] != NULL) {
openpam_log(PAM_LOG_ERROR,
"%s(%d): garbage at end of line",
filename, lineno);
+ errno = EINVAL;
goto fail;
}
ret = openpam_load_chain(pamh, servicename, fclt);
FREEV(wordc, wordv);
- if (ret < 0)
+ if (ret < 0) {
+ /*
+ * Bogus errno, but this ensures that the
+ * outer loop does not just ignore the
+ * error and keep searching.
+ */
+ if (errno == ENOENT)
+ errno = EINVAL;
goto fail;
+ }
continue;
}
@@ -230,6 +241,7 @@ openpam_parse_chain(pam_handle_t *pamh,
openpam_log(PAM_LOG_ERROR,
"%s(%d): missing or invalid control flag",
filename, lineno);
+ errno = EINVAL;
goto fail;
}
@@ -239,6 +251,7 @@ openpam_parse_chain(pam_handle_t *pamh,
openpam_log(PAM_LOG_ERROR,
"%s(%d): missing or invalid module name",
filename, lineno);
+ errno = EINVAL;
goto fail;
}
@@ -248,8 +261,11 @@ openpam_parse_chain(pam_handle_t *pamh,
this->flag = ctlf;
/* load module */
- if ((this->module = openpam_load_module(modulename)) == NULL)
+ if ((this->module = openpam_load_module(modulename)) == NULL) {
+ if (errno == ENOENT)
+ errno = ENOEXEC;
goto fail;
+ }
/*
* The remaining items in wordv are the module's
@@ -282,7 +298,11 @@ openpam_parse_chain(pam_handle_t *pamh,
* The loop ended because openpam_readword() returned NULL, which
* can happen for four different reasons: an I/O error (ferror(f)
* is true), a memory allocation failure (ferror(f) is false,
- * errno is non-zero)
+ * feof(f) is false, errno is non-zero), the file ended with an
+ * unterminated quote or backslash escape (ferror(f) is false,
+ * feof(f) is true, errno is non-zero), or the end of the file was
+ * reached without error (ferror(f) is false, feof(f) is true,
+ * errno is zero).
*/
if (ferror(f) || errno != 0)
goto syserr;
@@ -411,6 +431,9 @@ openpam_load_chain(pam_handle_t *pamh,
}
ret = openpam_load_file(pamh, service, facility,
filename, style);
+ /* success */
+ if (ret > 0)
+ RETURNN(ret);
/* the file exists, but an error occurred */
if (ret == -1 && errno != ENOENT)
RETURNN(ret);
@@ -420,7 +443,8 @@ openpam_load_chain(pam_handle_t *pamh,
}
/* no hit */
- RETURNN(0);
+ errno = ENOENT;
+ RETURNN(-1);
}
/*
@@ -441,8 +465,10 @@ openpam_configure(pam_handle_t *pamh,
openpam_log(PAM_LOG_ERROR, "invalid service name");
RETURNC(PAM_SYSTEM_ERR);
}
- if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0)
- goto load_err;
+ if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0) {
+ if (errno != ENOENT)
+ goto load_err;
+ }
for (fclt = 0; fclt < PAM_NUM_FACILITIES; ++fclt) {
if (pamh->chains[fclt] != NULL)
continue;
Modified: releng/9.2/contrib/sendmail/src/conf.c
==============================================================================
--- releng/9.2/contrib/sendmail/src/conf.c Tue Jun 3 19:02:52 2014
(r267017)
+++ releng/9.2/contrib/sendmail/src/conf.c Tue Jun 3 19:03:11 2014
(r267018)
@@ -5265,8 +5265,8 @@ closefd_walk(lowest, fd)
*/
void
-sm_close_on_exec(highest, lowest)
- int highest, lowest;
+sm_close_on_exec(lowest, highest)
+ int lowest, highest;
{
#if HASFDWALK
(void) fdwalk(closefd_walk, &lowest);
Modified: releng/9.2/sys/conf/newvers.sh
==============================================================================
--- releng/9.2/sys/conf/newvers.sh Tue Jun 3 19:02:52 2014
(r267017)
+++ releng/9.2/sys/conf/newvers.sh Tue Jun 3 19:03:11 2014
(r267018)
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="9.2"
-BRANCH="RELEASE-p6"
+BRANCH="RELEASE-p7"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
Modified: releng/9.2/sys/kern/kern_exec.c
==============================================================================
--- releng/9.2/sys/kern/kern_exec.c Tue Jun 3 19:02:52 2014
(r267017)
+++ releng/9.2/sys/kern/kern_exec.c Tue Jun 3 19:03:11 2014
(r267018)
@@ -280,6 +280,7 @@ kern_execve(td, args, mac_p)
struct mac *mac_p;
{
struct proc *p = td->td_proc;
+ struct vmspace *oldvmspace;
int error;
AUDIT_ARG_ARGV(args->begin_argv, args->argc,
@@ -296,6 +297,8 @@ kern_execve(td, args, mac_p)
PROC_UNLOCK(p);
}
+ KASSERT((td->td_pflags & TDP_EXECVMSPC) == 0, ("nested execve"));
+ oldvmspace = td->td_proc->p_vmspace;
error = do_execve(td, args, mac_p);
if (p->p_flag & P_HADTHREADS) {
@@ -310,6 +313,12 @@ kern_execve(td, args, mac_p)
thread_single_end();
PROC_UNLOCK(p);
}
+ if ((td->td_pflags & TDP_EXECVMSPC) != 0) {
+ KASSERT(td->td_proc->p_vmspace != oldvmspace,
+ ("oldvmspace still used"));
+ vmspace_free(oldvmspace);
+ td->td_pflags &= ~TDP_EXECVMSPC;
+ }
return (error);
}
Modified: releng/9.2/sys/kern/kern_ktrace.c
==============================================================================
--- releng/9.2/sys/kern/kern_ktrace.c Tue Jun 3 19:02:52 2014
(r267017)
+++ releng/9.2/sys/kern/kern_ktrace.c Tue Jun 3 19:03:11 2014
(r267018)
@@ -119,6 +119,7 @@ static int data_lengths[] = {
0, /* KTR_SYSCTL */
sizeof(struct ktr_proc_ctor), /* KTR_PROCCTOR */
0, /* KTR_PROCDTOR */
+ 0, /* unused */
sizeof(struct ktr_fault), /* KTR_FAULT */
sizeof(struct ktr_faultend), /* KTR_FAULTEND */
};
Modified: releng/9.2/sys/sys/proc.h
==============================================================================
--- releng/9.2/sys/sys/proc.h Tue Jun 3 19:02:52 2014 (r267017)
+++ releng/9.2/sys/sys/proc.h Tue Jun 3 19:03:11 2014 (r267018)
@@ -977,4 +977,5 @@ curthread_pflags_restore(int save)
#endif /* _KERNEL */
+#define TDP_EXECVMSPC 0x40000000 /* Execve destroyed old vmspace */
#endif /* !_SYS_PROC_H_ */
Modified: releng/9.2/sys/vm/vm_map.c
==============================================================================
--- releng/9.2/sys/vm/vm_map.c Tue Jun 3 19:02:52 2014 (r267017)
+++ releng/9.2/sys/vm/vm_map.c Tue Jun 3 19:03:11 2014 (r267018)
@@ -3669,6 +3669,8 @@ vmspace_exec(struct proc *p, vm_offset_t
struct vmspace *oldvmspace = p->p_vmspace;
struct vmspace *newvmspace;
+ KASSERT((curthread->td_pflags & TDP_EXECVMSPC) == 0,
+ ("vmspace_exec recursed"));
newvmspace = vmspace_alloc(minuser, maxuser);
if (newvmspace == NULL)
return (ENOMEM);
@@ -3685,7 +3687,7 @@ vmspace_exec(struct proc *p, vm_offset_t
PROC_VMSPACE_UNLOCK(p);
if (p == curthread->td_proc)
pmap_activate(curthread);
- vmspace_free(oldvmspace);
+ curthread->td_pflags |= TDP_EXECVMSPC;
return (0);
}
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
