pf: Do not allow negative ps_len in DIOCGETSTATES
ClosedPublic
Actions

Authored by kp on Apr 16 2020, 7:29 PM.

Tags

None

Referenced Files

	F157174986: D24447.id70652.diff
	Tue, May 19, 1:14 AM

	F157174972: D24447.id70688.diff
	Tue, May 19, 1:14 AM

	F157174701: D24447.diff
	Tue, May 19, 1:11 AM

	Unknown Object (File)
	Fri, May 15, 3:04 AM

	Unknown Object (File)
	Fri, May 15, 3:04 AM

	Unknown Object (File)
	Thu, May 14, 3:22 PM

	Unknown Object (File)
	Thu, May 14, 8:08 AM

	Unknown Object (File)
	Wed, May 6, 9:41 PM

Subscribers

Details

Reviewers

donner

Group Reviewers

network

Commits

rS360042: pf: Do not allow negative ps_len in DIOCGETSTATES

Summary

Userspace may pass a negative ps_len value to us, which causes an
assertion failure in malloc().
Treat negative values as zero, i.e. return the required size.

Reported-by: syzbot+53370d9d0358ee2a059a@syzkaller.appspotmail.com

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

kp created this revision.Apr 16 2020, 7:29 PM

Herald added subscribers: melifaro, farrokhi. · View Herald TranscriptApr 16 2020, 7:29 PM

Harbormaster completed remote builds in B30536: Diff 70652.Apr 16 2020, 7:29 PM

donner accepted this revision as: donner.Apr 16 2020, 8:32 PM

This revision is now accepted and ready to land.Apr 16 2020, 8:32 PM

Closed by commit rS360042: pf: Do not allow negative ps_len in DIOCGETSTATES (authored by kp). · Explain WhyApr 17 2020, 2:35 PM

This revision was automatically updated to reflect the committed changes.

kp added a commit: rS360042: pf: Do not allow negative ps_len in DIOCGETSTATES.

Herald added a subscriber: imp. · View Herald TranscriptApr 17 2020, 2:35 PM

Revision Contents
Changeset List

Path

Size

head/

sys/

netpfil/

pf/

pf_ioctl.c

2 lines

Diff 70688

View Options

head/sys/netpfil/pf/pf_ioctl.c

pf: Do not allow negative ps_len in DIOCGETSTATESClosedPublicActions