Page MenuHomeFreeBSD

setcred(): Fix 32-bit compatibility copy-in
ClosedPublic

Authored by olce on Nov 14 2025, 8:52 PM.
Tags
None
Referenced Files
Unknown Object (File)
Dec 4 2025, 10:22 AM
Unknown Object (File)
Dec 4 2025, 3:07 AM
Unknown Object (File)
Nov 28 2025, 9:26 AM
Unknown Object (File)
Nov 26 2025, 8:35 PM
Unknown Object (File)
Nov 25 2025, 9:41 AM
Unknown Object (File)
Nov 24 2025, 10:31 AM
Unknown Object (File)
Nov 20 2025, 6:25 AM
Unknown Object (File)
Nov 20 2025, 4:13 AM
Subscribers

Details

Summary

For 32-bit processes on 64-bit architectures, a difference of 'int'
pointers was wrongly used as a number of bytes to copy in a memcpy()
used to internally construct a 64-bit 'struct setcred' from the 32-bit
variant, leading to copying only part of the 32-bit structure, and thus
to requesting credentials with garbage IDs except for the real and
effective user IDs.

This bug was spotted by jhb@, who produced a slightly more invasive fix
in D53757 (a switch to using CP() on all fields). In the interest of
minimizing the diff for possible inclusion in 15.0, the commit here just
limits itself to fixing the number of bytes to copy.

Reported by: jhb
Fixes: ddb3eb4efe55 ("New setcred() system call and associated MAC hooks")
MFC after: 3 days
Sponsored by: The FreeBSD Foundation

Test Plan

Boot-up a VM and test that a 32-bit mdo(1) works.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable