Fri Aug 31 15:15:23 2018 UTC ()
Fix buffer overflow, detected by kASan.

	ifconfig gif0 create
	ifconfig gif0 up

[   50.682919] kASan: Unauthorized Access In 0xffffffff80f22655: Addr 0xffffffff81b997a0 [8 bytes, read]
[   50.682919] #0 0xffffffff8021ce6a in kasan_memcpy <netbsd>
[   50.692999] #1 0xffffffff80f22655 in m_copyback_internal <netbsd>
[   50.692999] #2 0xffffffff80f22e81 in m_copyback <netbsd>
[   50.692999] #3 0xffffffff8103109a in rt_msg1 <netbsd>
[   50.692999] #4 0xffffffff8159109a in compat_70_rt_newaddrmsg1 <netbsd>
[   50.692999] #5 0xffffffff81031b0f in rt_newaddrmsg <netbsd>
[   50.692999] #6 0xffffffff8102c35e in rt_ifa_addlocal <netbsd>
[   50.692999] #7 0xffffffff80a5287c in in6_update_ifa1 <netbsd>
[   50.692999] #8 0xffffffff80a54149 in in6_update_ifa <netbsd>
[   50.692999] #9 0xffffffff80a59176 in in6_ifattach <netbsd>
[   50.692999] #10 0xffffffff80a56dd4 in in6_if_up <netbsd>
[   50.692999] #11 0xffffffff80fc5cb8 in if_up_locked <netbsd>
[   50.703622] #12 0xffffffff80fcc4c1 in ifioctl_common <netbsd>
[   50.703622] #13 0xffffffff80fde694 in gif_ioctl <netbsd>
[   50.703622] #14 0xffffffff80fcdb1f in doifioctl <netbsd>


(maxv)
diff -r1.241 -r1.242 src/sys/net/rtsock.c
cvs diff -r1.241 -r1.242 src/sys/net/rtsock.c (expand / switch to unified diff)

--- src/sys/net/rtsock.c 2018/04/25 03:49:57 1.241
+++ src/sys/net/rtsock.c 2018/08/31 15:15:23 1.242
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: rtsock.c,v 1.241 2018/04/25 03:49:57 ozaki-r Exp $ */ 1/* $NetBSD: rtsock.c,v 1.242 2018/08/31 15:15:23 maxv Exp $ */
2 2
3/* 3/*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * Redistribution and use in source and binary forms, with or without 7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions 8 * modification, are permitted provided that the following conditions
9 * are met: 9 * are met:
10 * 1. Redistributions of source code must retain the above copyright 10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer. 11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright 12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the 13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution. 14 * documentation and/or other materials provided with the distribution.
@@ -51,27 +51,27 @@ @@ -51,27 +51,27 @@
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE. 58 * SUCH DAMAGE.
59 * 59 *
60 * @(#)rtsock.c 8.7 (Berkeley) 10/12/95 60 * @(#)rtsock.c 8.7 (Berkeley) 10/12/95
61 */ 61 */
62 62
63#include <sys/cdefs.h> 63#include <sys/cdefs.h>
64__KERNEL_RCSID(0, "$NetBSD: rtsock.c,v 1.241 2018/04/25 03:49:57 ozaki-r Exp $"); 64__KERNEL_RCSID(0, "$NetBSD: rtsock.c,v 1.242 2018/08/31 15:15:23 maxv Exp $");
65 65
66#ifdef _KERNEL_OPT 66#ifdef _KERNEL_OPT
67#include "opt_inet.h" 67#include "opt_inet.h"
68#include "opt_mpls.h" 68#include "opt_mpls.h"
69#include "opt_compat_netbsd.h" 69#include "opt_compat_netbsd.h"
70#include "opt_sctp.h" 70#include "opt_sctp.h"
71#include "opt_net_mpsafe.h" 71#include "opt_net_mpsafe.h"
72#endif 72#endif
73 73
74#include <sys/param.h> 74#include <sys/param.h>
75#include <sys/systm.h> 75#include <sys/systm.h>
76#include <sys/proc.h> 76#include <sys/proc.h>
77#include <sys/socket.h> 77#include <sys/socket.h>
@@ -1211,31 +1211,31 @@ COMPATNAME(rt_msg1)(int type, struct rt_ @@ -1211,31 +1211,31 @@ COMPATNAME(rt_msg1)(int type, struct rt_
1211 m_reset_rcvif(m); 1211 m_reset_rcvif(m);
1212 m_copyback(m, 0, datalen, data); 1212 m_copyback(m, 0, datalen, data);
1213 if (len > datalen) 1213 if (len > datalen)
1214 (void)memset(mtod(m, char *) + datalen, 0, len - datalen); 1214 (void)memset(mtod(m, char *) + datalen, 0, len - datalen);
1215 rtm = mtod(m, struct rt_xmsghdr *); 1215 rtm = mtod(m, struct rt_xmsghdr *);
1216 for (i = 0; i < RTAX_MAX; i++) { 1216 for (i = 0; i < RTAX_MAX; i++) {
1217 if ((sa = rtinfo->rti_info[i]) == NULL) 1217 if ((sa = rtinfo->rti_info[i]) == NULL)
1218 continue; 1218 continue;
1219 rtinfo->rti_addrs |= (1 << i); 1219 rtinfo->rti_addrs |= (1 << i);
1220 dlen = RT_XROUNDUP(sa->sa_len); 1220 dlen = RT_XROUNDUP(sa->sa_len);
1221 m_copyback(m, len, sa->sa_len, sa); 1221 m_copyback(m, len, sa->sa_len, sa);
1222 if (dlen != sa->sa_len) { 1222 if (dlen != sa->sa_len) {
1223 /* 1223 /*
1224 * Up to 6 + 1 nul's since roundup is to 1224 * Up to 7 + 1 nul's since roundup is to
1225 * sizeof(uint64_t) (8 bytes) 1225 * sizeof(uint64_t) (8 bytes)
1226 */ 1226 */
1227 m_copyback(m, len + sa->sa_len, 1227 m_copyback(m, len + sa->sa_len,
1228 dlen - sa->sa_len, "\0\0\0\0\0\0"); 1228 dlen - sa->sa_len, "\0\0\0\0\0\0\0");
1229 } 1229 }
1230 len += dlen; 1230 len += dlen;
1231 } 1231 }
1232 if (m->m_pkthdr.len != len) 1232 if (m->m_pkthdr.len != len)
1233 goto out; 1233 goto out;
1234 rtm->rtm_msglen = len; 1234 rtm->rtm_msglen = len;
1235 rtm->rtm_version = RTM_XVERSION; 1235 rtm->rtm_version = RTM_XVERSION;
1236 rtm->rtm_type = type; 1236 rtm->rtm_type = type;
1237 return m; 1237 return m;
1238out: 1238out:
1239 m_freem(m); 1239 m_freem(m);
1240 return NULL; 1240 return NULL;
1241} 1241}