src/sys, branch stable/11 FreeBSD source tree zlib: Fix a bug when getting a gzip header extra field with inflate(). 2023-01-24T22:27:50+00:00 Mark Adler fork@madler.net 2022-07-30T22:51:11+00:00 e59d10aff6edc088850be553252020230a560514 If the extra field was larger than the space the user provided with inflateGetHeader(), and if multiple calls of inflate() delivered the extra header data, then there could be a buffer overflow of the provided space. This commit assures that provided space is not exceeded. (cherry picked from zlib commit eff308af425b67093bab25f80f1ae950166bece1) (cherry picked from zlib commit 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d) (cherry picked from commit dc3509f1aafcd966f3dd9226115cf94b691ff3c7) (cherry picked from commit 2969066f73fc67a614144ac09b9f3f5291937fed) (cherry picked from commit 10cc2bf5f7a592981ee00d22eb13e100beed1e64) 
If the extra field was larger than the space the user provided with
inflateGetHeader(), and if multiple calls of inflate() delivered
the extra header data, then there could be a buffer overflow of the
provided space. This commit assures that provided space is not
exceeded.

(cherry picked from zlib commit eff308af425b67093bab25f80f1ae950166bece1)
(cherry picked from zlib commit 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d)

(cherry picked from commit dc3509f1aafcd966f3dd9226115cf94b691ff3c7)
(cherry picked from commit 2969066f73fc67a614144ac09b9f3f5291937fed)
(cherry picked from commit 10cc2bf5f7a592981ee00d22eb13e100beed1e64)
tcp: Correctly compute the retransmit length for all 64-bit platforms. 2022-06-06T20:09:38+00:00 Hans Petter Selasky hselasky@FreeBSD.org 2022-06-02T18:33:21+00:00 bc92b6240ddf6ab11813abe439653308da14ee54 When the TCP sequence number subtracted is greater than 2**32 minus the window size, or 2**31 minus the window size, the use of unsigned long as an intermediate variable, may result in an incorrect retransmit length computation on all 64-bit platforms. While at it create a helper macro to facilitate the computation of the difference between two TCP sequence numbers. Differential Revision: https://reviews.freebsd.org/D35388 Reviewed by: rscheff Sponsored by: NVIDIA Networking (cherry picked from commit 28173d49dccb91e50be9c401dbad1da908a5dc75) 
When the TCP sequence number subtracted is greater than 2**32 minus
the window size, or 2**31 minus the window size, the use of unsigned
long as an intermediate variable, may result in an incorrect retransmit
length computation on all 64-bit platforms.

While at it create a helper macro to facilitate the computation of
the difference between two TCP sequence numbers.

Differential Revision:	https://reviews.freebsd.org/D35388
Reviewed by:	rscheff
Sponsored by:	NVIDIA Networking

(cherry picked from commit 28173d49dccb91e50be9c401dbad1da908a5dc75)
xhci(4): Always add and evaluate the slot context. 2022-05-04T07:30:12+00:00 Hans Petter Selasky hselasky@FreeBSD.org 2022-05-03T16:10:49+00:00 cacb5f3ea5d39d9ee02e6f278993fb1b308ca9ba Because the maximum number of endpoint contexts is stored there. Tested by: ehaupt@ PR: 262882 Sponsored by: NVIDIA Networking (cherry picked from commit 09dd1adfa4c9bb1b49f4ef5524a308732883e132) 
Because the maximum number of endpoint contexts is stored there.

Tested by:	ehaupt@
PR:		262882
Sponsored by:	NVIDIA Networking

(cherry picked from commit 09dd1adfa4c9bb1b49f4ef5524a308732883e132)
xhci(4): Only drop BULK and INTERRUPT endpoints to reset data toggle. 2022-05-04T07:30:07+00:00 Hans Petter Selasky hselasky@FreeBSD.org 2022-05-03T16:09:17+00:00 a1ec8baee5dd0cb8e344ab0e2feafcf49f4a802a Only drop BULK and INTERRUPT endpoints, to reset the data toggle, because for other endpoint types this is not critical. Tested by: ehaupt@ PR: 262882 Sponsored by: NVIDIA Networking (cherry picked from commit e276d281503160ba3648bd394cde95736ee53329) 
Only drop BULK and INTERRUPT endpoints, to reset the data toggle,
because for other endpoint types this is not critical.

Tested by:	ehaupt@
PR:		262882
Sponsored by:	NVIDIA Networking

(cherry picked from commit e276d281503160ba3648bd394cde95736ee53329)
xhci(4): Ensure the so-called data toggle gets properly reset. 2022-04-27T19:17:46+00:00 Hans Petter Selasky hselasky@FreeBSD.org 2022-04-21T14:59:09+00:00 683c36ae04abac55841271b3d9a65c0eb5b7155c Use the drop and enable endpoint context commands to force a reset of the data toggle for USB 2.0 and USB 3.0 after: - clear endpoint halt command (when the driver wishes). - set config command (when the kernel or user-space wants). - set alternate setting command (only affected endpoints). Some XHCI HW implementations may not allow the endpoint reset command when the endpoint context is not in the halted state. Reported by: Juniper and Gary Jennejohn Sponsored by: NVIDIA Networking (cherry picked from commit cda31e734925346328fd2369585ab3f6767ec225) 
Use the drop and enable endpoint context commands to force a reset of
the data toggle for USB 2.0 and USB 3.0 after:
 - clear endpoint halt command (when the driver wishes).
 - set config command (when the kernel or user-space wants).
 - set alternate setting command (only affected endpoints).

Some XHCI HW implementations may not allow the endpoint reset command when
the endpoint context is not in the halted state.

Reported by:		Juniper and Gary Jennejohn
Sponsored by:		NVIDIA Networking

(cherry picked from commit cda31e734925346328fd2369585ab3f6767ec225)
No need to stop XHCI endpoints in disabled state. 2022-04-27T19:17:40+00:00 Hans Petter Selasky hselasky@FreeBSD.org 2020-12-23T10:54:42+00:00 b199e55ce6d9ec938933cb86fbad04fb064910d9 Some AMD XHCI implementations apparently assert a permanent internal failure if this happens. Submitted by: ali.abdallah@suse.com PR: 251503 Sponsored by: Mellanox Technologies // NVIDIA Networking (cherry picked from commit 1622a498525b4ef0d23d30a587b9a3888c3ee0d5) 
Some AMD XHCI implementations apparently assert a permanent
internal failure if this happens.

Submitted by:	ali.abdallah@suse.com
PR:		251503
Sponsored by:	Mellanox Technologies // NVIDIA Networking

(cherry picked from commit 1622a498525b4ef0d23d30a587b9a3888c3ee0d5)
net80211: validate Mesh ID length in ieee80211_parse_beacon 2022-04-06T14:19:42+00:00 Bjoern A. Zeeb bz@FreeBSD.org 2022-04-05T22:52:51+00:00 9752bffbcfbadf1749a2c12449603952c61bb4ab Reported by: m00nbsd working with Trend Micro Zero Day Initiative (cherry picked from commit fb8c87b4f3bfdfac014f9d894fe75fbad0391b24) (cherry picked from commit 72617f9246e3a4be28eeafeae1bdd983143eef3e) (cherry picked from commit e7c990ba3f8de8c4882390cad9b01a9fa25ad068) 
Reported by:	m00nbsd working with Trend Micro Zero Day Initiative

(cherry picked from commit fb8c87b4f3bfdfac014f9d894fe75fbad0391b24)
(cherry picked from commit 72617f9246e3a4be28eeafeae1bdd983143eef3e)
(cherry picked from commit e7c990ba3f8de8c4882390cad9b01a9fa25ad068)
mpr/mps/mpt: verify cfg page ioctl lengths 2022-04-06T14:19:28+00:00 Ed Maste emaste@FreeBSD.org 2022-03-28T13:33:54+00:00 b2bdfad93ba8567c40a01728a35d732e3206716d *_CFG_PAGE ioctl handlers in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Add checks that the size is at least the required minimum. Note that the device nodes are owned by root:operator with 0640 permissions so the ioctls are not available to unprivileged users. This change includes suggestions from scottl, markj and mav. Two of the mpt cases were reported by Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative; scottl reported the third case in mpt. Same issue found in mpr and mps after discussion with imp. Reported by: Lucas Leong (@_wmliang_), Trend Micro Zero Day Initiative Reviewed by: imp, mav MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D34692 (cherry picked from commit 8276c4149b5fc7c755d6b244fbbf6dae1939f087) 
*_CFG_PAGE ioctl handlers in the mpr, mps, and mpt drivers allocated a
buffer of a caller-specified size, but copied to it a fixed size header.
Add checks that the size is at least the required minimum.

Note that the device nodes are owned by root:operator with 0640
permissions so the ioctls are not available to unprivileged users.

This change includes suggestions from scottl, markj and mav.

Two of the mpt cases were reported by Lucas Leong (@_wmliang_) of
Trend Micro Zero Day Initiative; scottl reported the third case in mpt.
Same issue found in mpr and mps after discussion with imp.

Reported by:	Lucas Leong (@_wmliang_), Trend Micro Zero Day Initiative
Reviewed by:	imp, mav
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D34692

(cherry picked from commit 8276c4149b5fc7c755d6b244fbbf6dae1939f087)
zlib: apply upstream fix for CVE-2018-25032 2022-04-04T11:00:46+00:00 Eugene Grosbein eugen@FreeBSD.org 2022-04-04T11:00:46+00:00 7f4fcc62edee9b3dad47ae542a5be942b5df6552 Fix memory corruption when deflating (i.e., when compressing) if the input has many distant matches. This is direct commit to stable/11 using unmodified upstream fix https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531 Security: CVE-2018-25032 
Fix memory corruption when deflating (i.e., when compressing)
if the input has many distant matches.

This is direct commit to stable/11 using unmodified upstream fix
https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531

Security:	CVE-2018-25032
netmap: Fix TOCTOU vulnerability in nmreq_copyin 2022-03-30T22:08:32+00:00 Vincenzo Maffione vmaffione@FreeBSD.org 2022-03-16T06:58:50+00:00 725c70d8153f4bddf95bdd07e2c7b4b9399643f6 The total size of the user-provided nmreq was first computed and then trusted during the copyin. This might lead to kernel memory corruption and escape from jails/containers. Reported by: Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative Security: CVE-2022-23084 MFC after: 3 days (cherry picked from commit 393729916564ed13f966e09129a24e6931898d12) 
The total size of the user-provided nmreq was first computed and then
trusted during the copyin. This might lead to kernel memory corruption
and escape from jails/containers.

Reported by: Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative
Security: CVE-2022-23084
MFC after:	3 days

(cherry picked from commit 393729916564ed13f966e09129a24e6931898d12)