src/usr.sbin, branch releng/14.0

bhyve: improve input validation in pci_xhci

2024-09-19T13:08:03+00:00

Several functions did not validate the slot index resulting in OOB read
on the heap of the slot device structure which could lead to arbitrary
reads/writes and potentially code execution.

Reported by:	Synacktiv
Reviewed by:	markj (earlier), jhb
Approved by:	so
Security:	FreeBSD-SA-24:15.bhyve
Security:	CVE-2024-41721
Security:	HYP-02
Sponsored by:	The Alpha-Omega Project
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D45996

(cherry picked from commit e72d86ad9c62c8054d7977a71f08e68ef755c132)
(cherry picked from commit 419da61f8203ac475550ae4b0971dbef10f811f2)

bhyve: fix off by one error in pci_xhci

2024-09-04T20:54:03+00:00

The function pci_xhci_find_stream validates that the streamid is valid
but the bound check accepts up to ep_MaxPStreams included.

The bug results in an out-of-bounds write on the heap with controlled
data.

Reported by:	Synacktiv
Reviewed by:	jhb
Security:	FreeBSD-SA-24:12.bhyve
Security:	CVE-2024-32668
Security:	HYP-04
Sponsored by:	The Alpha-Omega Project
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D45994

(cherry picked from commit 5c9308a4130858598c76f3ae6e3e3dfb41ccfe68)
(cherry picked from commit 90af1336ed5e3c8556147325c4841c68639c4b63)

Approved by:	so

bhyve: fix Out-Of-Bounds read/write heap in tpm_ppi_mem_handler

2024-09-04T20:53:58+00:00

The function tpm_ppi_mem_handler is vulnerable to buffer over-read and
over-write, the MMIO handler serves the heap allocated structure
tpm_ppi_qemu.
The issue is that the structure size is smaller than 0x1000 and the
handler does not validate the offset and size (sizeof is 0x15A while the
handler allows up to 0x1000 bytes)

Reported by:	Synacktiv
Reviewed by:	corvink
Security:	FreeBSD-SA-24:10.bhyve
Security:	CVE-2024-41928
Security:	HYP-01
Sponsored by:	The Alpha-Omega Project
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D45980

(cherry picked from commit a06fc21e770a482c8915411ebc98c870e42dd29b)
(cherry picked from commit 6ce4821f0859eb00e1754917e1471184755b6358)

Approved by:	so

periodic/daily/480.leapfile-ntpd: only attempt to refresh leap-seconds.list

2024-02-14T06:19:01+00:00

when ntpd is enabled.

The leap-seconds.list is used exclusively by ntpd, therefore, do not bother
to perform the fetch when ntpd is not enabled.

PR:		conf/275419
Reviewed by:	cy, michaelo, imp
Differential Revision: https://reviews.freebsd.org/D42875

(cherry picked from commit 3b3195f6767b39eb33b3523134ef988931c9c86d)
(cherry picked from commit 52369c5d29f5f291bfc98270cf13768633abe322)

Security:       FreeBSD-EN-24:01.tzdata
Approved by:	so (gordon)

bhyveload: use a dirfd to support -h

2024-02-14T05:41:59+00:00

Don't allow lookups from the loader scripts, which in rare cases may be
in guest control depending on the setup, to leave the specified host
root.  Open the root dir and strictly do RESOLVE_BENEATH lookups from
there.

cb_open() has been restructured a bit to work nicely with this, using
fdopendir() in the directory case and just using the fd we already
opened in the regular file case.

hostbase_open() was split out to provide an obvious place to apply
rights(4) if that's something we care to do.

Reviewed by:	allanjude (earlier version), markj
Approved by:	so
Security:	FreeBSD-SA-24:01.bhyveload
Security:	CVE-2024-25940

(cherry picked from commit 6779d44bd878e3cf4723f7386b11da6508ab5431)
(cherry picked from commit 426b28fdf700bcd8c05b25665da34f806b27b1bb)

makefs/zfs: Don't set ZFS_NO_EXECS_DENIED in file flags

2023-11-09T16:26:33+00:00

This flag was leftover from testing and should have been removed.

Approved by:	re (cperciva)
PR:		274938
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit 50565cf514d32ee02a24f420551c7e65631b0716)
(cherry picked from commit a8043cc0d49bec7bebc4afc43b8bf5f6ab730b23)

bhyve: fix arguments to ioctl(VMIO_SIOCSIFFLAGS)

2023-10-26T20:28:23+00:00

ioctl(2)'s with integer argument shall pass command argument by value,
not by pointer.  The ioctl(2) manual page is not very clear about that.
See sys/kern/sys_generic.c:sys_ioctl() near IOC_VOID.

Approved by:		re (gjb)
Reviewed by:		markj
Differential Revision:	https://reviews.freebsd.org/D42366
Fixes:			fd8b9c73a5a63a7aa438a73951d7a535b4f25d9a

(cherry picked from commit f407a72a506d2630d60d9096c42058f12dff874e)
(cherry picked from commit 6f1ccbd587907c5eaf05ddd77d1e9f5e16b7aedc)

makefs/zfs: Update dd_used_breakdown after writing the MOS

2023-10-25T16:56:05+00:00

Approved by:	re (gjb)
Fixes:	96092bf9108c ("makefs/zfs: Fill out dd_used_breakdown fields in DSL directories")
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit c9c029507f80b31fb67b1b545f3062c7266d5f9e)

makefs/zfs: Fill out dd_used_breakdown fields in DSL directories

2023-10-25T16:55:52+00:00

This is required for the "used", "usedds" and "usedchild" dataset
properties to be displayed.

Approved by:	re (gjb)
PR:		274613
Reported by:	Mike Tancsa 
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit eb5cbd793e31f9d656999033be54dac1a1107294)

bhyve: Use VMIO_SIOCSIFFLAGS instead of SIOCGIFFLAGS

2023-10-25T16:52:37+00:00

Creating an IP socket to invoke the SIOCGIFFLAGS ioctl on is the only
thing preventing bhyve from working inside a bhyve jail with IPv4 and
IPv6 disabled restricting the jailed bhyve process to only access the
host network via a tap/vmnet device node.

Approved by:	re (gjb)
PR:		273557
Fixes:		56be282bc999 ("bhyve: net_backends, automatically IFF_UP tap devices")
Reviewed by:	markj
MFC after:	1 week

(cherry picked from commit fd8b9c73a5a63a7aa438a73951d7a535b4f25d9a)
(cherry picked from commit 700689bc2abaf860801b3896ceae86b0072f406c)