src/sys/libkern, branch stable/10

MFC r330027

2018-03-05T16:00:05+00:00

iconv uses strlen directly on user supplied memory

`iconv_sysctl_add` from `sys/libkern/iconv.c` incorrectly limits the
size of user strings, such that several out of bounds reads could have
been possible.

static int
iconv_sysctl_add(SYSCTL_HANDLER_ARGS)
{
	struct iconv_converter_class *dcp;
	struct iconv_cspair *csp;
	struct iconv_add_in din;
	struct iconv_add_out dout;
	int error;

	error = SYSCTL_IN(req, &din, sizeof(din));
	if (error)
		return error;
	if (din.ia_version != ICONV_ADD_VER)
		return EINVAL;
	if (din.ia_datalen > ICONV_CSMAXDATALEN)
		return EINVAL;
	if (strlen(din.ia_from) >= ICONV_CSNMAXLEN)
		return EINVAL;
	if (strlen(din.ia_to) >= ICONV_CSNMAXLEN)
		return EINVAL;
	if (strlen(din.ia_converter) >= ICONV_CNVNMAXLEN)
		return EINVAL;
...

Since the `din` struct is directly copied from userland, there is no
guarantee that the strings supplied will be NULL terminated. The
`strlen` calls could continue reading past the designated buffer
sizes.

Declaration of `struct iconv_add_in` is found in `sys/sys/iconv.h`:

struct iconv_add_in {
	int	ia_version;
	char	ia_converter[ICONV_CNVNMAXLEN];
	char	ia_to[ICONV_CSNMAXLEN];
	char	ia_from[ICONV_CSNMAXLEN];
	int	ia_datalen;
	const void *ia_data;
};

Our strings are followed by the `ia_datalen` member, which is checked
before the `strlen` calls:

if (din.ia_datalen > ICONV_CSMAXDATALEN)

Since `ICONV_CSMAXDATALEN` has value `0x41000` (and is `unsigned`),
this ensures that `din.ia_datalen` contains at least 1 byte of 0, so
it is not possible to trigger a read out of bounds of the `struct`
however, this code is fragile and could introduce subtle bugs in the
future if the `struct` is ever modified.

PR:		207302
Submitted by:	CTurt 
Reported by:	CTurt 
Sponsored by:	Dell EMC

MFC r318514-r318515, r318517, r318917

2017-05-31T06:26:37+00:00

r318514:
Use size_t.

Inspired by:	OpenBSD src/lib/libc/stdlib/qsort.c,v 1.11

r318515:
The current qsort(3) implementation ignores the sizes of partitions, and
always perform recursion on the left partition, then use a tail call to
handle the right partition.  In the worst case this could require O(N)
levels of recursions.

Reduce the possible recursion level to log2(N) by always recursing on the
smaller partition instead.

Obtained from:	PostgreSQL 9d6077abf9d6efd992a59f05ef5aba981ea32096

r318517:
Sync qsort.c with userland r318515.

(Note that MIN macro is removed in favor of sys/param.h's version).

PR:		213922

r318917:
Disconnect heimdal version of qsort.c from build because we are already
using libc's version of qsort.

PR:		bin/213922

MFC r311989 (cem):

2017-05-31T06:00:14+00:00

libkern: Remove obsolete 'register' keyword

MFC r315225:

2017-03-14T06:12:51+00:00

Discard first 3072 bytes of RC4 keystream, this is a bandaid
that allows us to work on switching to a more modern PRNG.

Submitted by:	Steven Chamberlain 
Approved by:	so

MFC: r284583, r285797, r285799, r287168, r298714, r298720, r298838,

2016-09-30T22:40:58+00:00

	r300879

Merge ACPICA up to 20160527.

Requested by:	mav

MFC r279433 (by rstone): Implement asprintf in libkern

2015-10-05T09:46:23+00:00

MFC r277901:

2015-02-02T08:05:11+00:00

Fix a -Wcast-qual warning in libkern's strtol(), by using __DECONST.  No
functional change.

MFC r277903:

Similar to r277901, fix more -Wcast-qual warnings in libkern's strtoq(),
strtoul() and strtouq(), by using __DECONST.  No functional change.

Clean up our ARM assembly:

2014-12-14T16:28:53+00:00

MFC 275256:

Switch to the ARM unified assembly language as the clang integrated as only
supports it. Binutils supports it when the ".syntax unified" directive
is set.

Sponsored by:   ABT Systems Ltd

MFC 275264:

Update _ENTRY to use _EENTRY to reduce the common code.

MFC 275321:

Remove extra labels, ENTRY_NP already provides them.

Sponsored by:   ABT Systems Ltd

MFC 275322:

Correctly a few incorrect uses of ENTRY/EENTRY and END/EEND

Sponsored by:   ABT Systems Ltd

MFC 275416:

Fix the name of the coprocessor to include the "p" prefix, the clang
integrated assembler expects this.

Sponsored by:   ABT Systems Ltd

MFC 275418:

Switch to unified syntax so these can be built with clang 3.5.

Sponsored by:   ABT Systems Ltd

MFC 275519:

Add missing END macros to some of the xscale functions.

Sponsored by:   ABT Systems Ltd

MFC 275520:

Use the unified syntax in a few more assembly files

Sponsored by:   ABT Systems Ltd

MFC 275521:

Set the alignment to 4-bytes after a string as clang 3.5 can switch to
thumb mode if this is incorrect.

Sponsored by:   ABT Systems Ltd

MFC 275522:

Place the literal pool after a RET otherwise clang 3.5 tries to put it too
far away from a ldr psuedo instruction. With this clang will place the
literal value here where it's close enough to be loaded.

Sponsored by:   ABT Systems Ltd

MFC 275523:

Switch to an armv6k cpu, without this clang 3.5 complains "bx lr" is
unsupported as it needs a newer cpu.

Sponsored by:   ABT Systems Ltd

MFC 275524:

Switch to a .cpu directive. These will work when clang 3.5 is imported
where the .arch directive is a nop.

Sponsored by:   ABT Systems Ltd

MFC r274636:

2014-12-04T23:21:42+00:00

Sync with userland variant.

MFC: 272906

2014-11-13T21:58:42+00:00

Change the PF hash from Jenkins to Murmur3.  In forwarding tests
this showed a conservative 3% incrase in PPS.

Original Differential Revision:	https://reviews.freebsd.org/D461
Submitted by:	des
Reviewed by:	emaste