aboutsummaryrefslogtreecommitdiff
path: root/sys/contrib/libnv
Commit message (Collapse)AuthorAgeFilesLines
* libnv: fix heap overflow in nvlist_recv()Mariusz Zaborski2026-04-291-4/+5
| | | | | | | | | | | | | | | | nvlist_check_header() validated nvlh_size for overflow before performing conversion. An mallicous user can set NV_FLAG_BIG_ENDIAN in the header and craft nvlh_size so that the orginall value passes the check, but after the conversion the sizeof(nvlist_header) + size can overflow. This can lead to a heap buffer overflow. Approved by: so Security: FreeBSD-SA-26:17.libnv Security: CVE-2026-35547 Fixes: 36fa90dbde0060aacb5677d0b113ee168e839071 Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D56342
* libnv: Fix a length check in nvpair_unpack_string_array()Mark Johnston2025-10-151-4/+4
| | | | | | | | | | | | | | | A string array is represented by a set of nul-terminated strings concatenated together. For each string, we check to see if there's a nul terminator at the end, taking care to avoid going past the end of the buffer. However, the code fails to handle the possibility that size == 0 at the end of an iteration, leading to underflow. Fix the length check. Reported by: Ilja van Sprundel <ivansprundel@ioactive.com> Reviewed by: emaste MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D53069
* libnv: Fix handling of nvlist_dump() and nvlist_send() for child nvlistsMark Johnston2025-09-101-2/+8
| | | | | | | | | | | | | | | Suppose an nvlist nvl belongs to a parent nvlist or nvlist array. In this case, nvl contains a pointer to its container. This trips up nvlist_send(nvl) and nvlist_dump(nvl), which intuitively should only operate on nvl and its nvpairs. In particular, both of these functions will traverse to nvl's parent and start sending/dumping the parent's nvpairs, which results in assertion failures or nonsensical output, respectively. Reviewed by: oshogbo MFC after: 2 weeks Sponsored by: Innovate UK Differential Revision: https://reviews.freebsd.org/D52360
* machine/stdarg.h -> sys/stdarg.hBrooks Davis2025-06-114-8/+4
| | | | | | | | | | | | | Switch to using sys/stdarg.h for va_list type and va_* builtins. Make an attempt to insert the include in a sensible place. Where style(9) was followed this is easy, where it was ignored, aim for the first block of sys/*.h headers and don't get too fussy or try to fix other style bugs. Reviewed by: imp Exp-run by: antoine (PR 286274) Pull Request: https://github.com/freebsd/freebsd-src/pull/1595
* libnv: correct the calculation of the structure's sizeMariusz Zaborski2024-09-111-1/+1
| | | | Reported by: Milosz Kaniewski <milosz.kaniewski@gmail.com>
* libnv: add tests to verify potential overflow issuesMariusz Zaborski2024-09-042-7/+8
| | | | Differential Revision: https://reviews.freebsd.org/D46131
* libnv: verify that string is null terminatedMariusz Zaborski2024-09-041-0/+4
| | | | | | | | | | | | | | | | During unpacking, we ensure that we do not read beyond the declared size. However, unpack uses a function that copies null-terminated strings. Prior to this commit, if the last string was not null-terminated, it could result in copying data into a buffer smaller than the allocated size. Security: FreeBSD-24:09.libnv Security: CVE-2024-45288 Security: CAP-03 Reported by: Synacktiv Sponsored by: The Alpha-Omega Project Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46138
* libnv: allocate buffer in a safe wayMariusz Zaborski2024-09-042-11/+15
| | | | | | | | | | | | | | Ensure that the calculation of size of array doesn't overflow. Security: FreeBSD-24:09.libnv Security: CVE-2024-45287 Security: CAP-02 Reported by: Synacktiv Reported by: Taylor R Campbell (NetBSD) Sponsored by: The Alpha-Omega Project Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46131
* spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDWarner Losh2023-05-127-7/+7
| | | | | | | | | The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch up to that fact and revert to their recommended match of BSD-2-Clause. Discussed with: pfg MFC After: 3 days Sponsored by: Netflix
* libnv: Mark a variable only used in a custom assertion as unused.John Baldwin2022-04-131-1/+1
|
* libnv: read entire datagram in nvlist_recv()Robert Wing2021-12-061-6/+17
| | | | | | | | | | | | When SOCK_DGRAM is used, a portion of the datagram is discarded during the initial recv() when getting the nvlist_header. To workaround this, use MSG_PEEK for the initial recv() when using a datagram socket. Add tests for SOCK_DGRAM with nvlist_send()/nvlist_recv(). Differential Revision: https://reviews.freebsd.org/D32722
* libnv: let nvlist_recv() pass flags to recv()Robert Wing2021-12-061-2/+2
| | | | Differential Revision: https://reviews.freebsd.org/D32721
* libnv: Fix array unpack endianness logicStefan Grundmann2021-09-131-0/+2
| | | | | | | | | | | | | | | | | | | | When a nvlist(9) is converted into a binary buffer by nvlist_pack(9), the host endianness is encoded in the nvlist_header of the binary buffer. The nvlist_unpack(9) function converts a given binary buffer to an nvlist. In the conversion process the endianness encoded in the nvlist_header is evaluated and -- should the encoded endianness differ from the endianess of the decoding host -- endianness conversion is applied to nvlist_header and nvpair_header elements as well as to some nvpair values. In 2015 @oshogbo extended libnv with array support (in 347a39b). The unpacking code misses the possible need to convert the endianness of the nvph_nitems element of nvpair_headers. The patch (re)enables libnv to unpack nvlists regardless of the endianness of the packing host. Pull Request: https://github.com/freebsd/freebsd-src/pull/528
* Remove "All Rights Reserved" from FreeBSD Foundation sys/ copyrightsEd Maste2021-08-081-1/+0
| | | | | | | These ones were unambiguous cases where the Foundation was the only listed copyright holder (in the associated license block). Sponsored by: The FreeBSD Foundation
* libnv: optimize nvlist size calculationMariusz Zaborski2021-06-111-71/+53
| | | | | | | | | | | | | | | | | | | If we had a multiple nvlist, during nvlist_pack, we calculated the size of every nvlist separately. For example, if we had a nvlist with three nodes each containing another (A contains B, and B contains C), we first calculated the size of nvlist A (which contains B, C), then we calculate the size of B (which contains C, notice that we already did the calculation of B, when we calculate A), and finally C. This means that this calculation was O(N!). This was done because each time we pack nvlist, we have to put its size in the header (the separate header for A, B, and C). To not break the ABI and to reduce the complexity of nvlist_size, instead of calculating the nvlist size when requested, we track the size of each nvlist. Reported by: pjd, kp Tested by: kp
* libnv: Allow use in non-sleepable contextsKristof Provost2021-04-071-4/+4
| | | | | | | | | | | | | | | 44c125c4cebc2fd87c6260b90eddae11201f5232 switched the nvlist allocations to be M_WAITOK, but this precludes the use in non-sleepable contexts. (E.g. with a nonsleepable lock held). All callers for these allocation functions already cope with memory alloation failures, so there's no reason to allow sleeping during allocations. Reviewed by: melifaro, oshogbo MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29556
* Rename nvpair.c to bsd_nvpair.c to not conflict with openzfs' version.Matt Macy2020-06-271-0/+0
| | | | Notes: svn path=/head/; revision=362666
* The nvlist_report_missing is also used by the cnvlist.Mariusz Zaborski2019-04-111-1/+1
| | | | | | | | | | It can't be a static one. Reported by: jenkins MFC after: 2 weeks Notes: svn path=/head/; revision=346115
* libnv: fix compilation warningsMariusz Zaborski2019-04-111-3/+4
| | | | | | | | | | | When building libnv without a debug those arguments are no longer used because assertions will be changed to NOP. Submitted by: Mindaugas Rasiukevicius <rmind@netbsd.org> MFC after: 2 weeks Notes: svn path=/head/; revision=346113
* libnv: fix compilation warningsMariusz Zaborski2019-04-111-3/+3
| | | | | | | | | | | When building libnv without a debug those arguments are no longer used because assertions will be changed to NOP. Submitted by: Mindaugas Rasiukevicius <rmind@netbsd.org> MFC after: 2 weeks Notes: svn path=/head/; revision=346112
* libnv: fix revertMariusz Zaborski2019-02-171-2/+2
| | | | | | | Reported by: jenkins Notes: svn path=/head/; revision=344236
* libnv: fix double freeMariusz Zaborski2019-02-171-8/+0
| | | | | | | | | | | | In r343986 we introduced a double free. The structure was already freed fixed in the r302966. This problem was introduced because the GitHub version was out of sync with the FreeBSD one. Submitted by: Mindaugas Rasiukevicius <rmind@netbsd.org> MFC with: r343986 Notes: svn path=/head/; revision=344235
* libnv: fix memory leaksMariusz Zaborski2019-02-101-0/+1
| | | | | | | | | Free the data array for NV_TYPE_DESCRIPTOR_ARRAY case. MFC after: 2 weeks Notes: svn path=/head/; revision=343987
* libnv: fix memory leaksMariusz Zaborski2019-02-103-4/+21
| | | | | | | | | | | | | | | | | | nvpair_create_stringv: free the temporary string; this fix affects nvlist_add_stringf() and nvlist_add_stringv(). nvpair_remove_nvlist_array (NV_TYPE_NVLIST_ARRAY case): free the chain of nvpairs (as resetting it prevents nvlist_destroy() from freeing it). Note: freeing the chain in nvlist_destroy() is not sufficient, because it would still leak through nvlist_take_nvlist_array(). This affects all nvlist_*_nvlist_array() use Submitted by: Mindaugas Rasiukevicius <rmind@netbsd.org> Reported by: clang/gcc ASAN MFC after: 2 weeks Notes: svn path=/head/; revision=343986
* Ensure that libnv can be used when kern.trap_enotcap=1.Mark Johnston2018-11-131-14/+0
| | | | | | | | | | | | | | | | | | | libnv used fcntl(fd, F_GETFL) to test whether fd is a valid file descriptor. Aside from being racy, this check requires CAP_FCNTL rights on fd. Instead, use fcntl(fd, F_GETFD), which does not require any capability rights. Also remove some redundant fd_is_valid() checks to avoid extra system calls; in many cases we were performing this check immediately before dup()ing the descriptor. Reviewed by: cem, oshogbo (previous version) MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D17963 Notes: svn path=/head/; revision=340408
* Really fix the style.Li-Wen Hsu2018-06-191-1/+1
| | | | | | | | Approved by: oshogbo Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=335382
* style(9) fix, I was also going to silence gcc.Li-Wen Hsu2018-06-191-0/+1
| | | | | | | | Approved by: emaste, oshogbo Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=335380
* Set prev to NULL so its garaunteed to have a value of some kind andSean Bruno2018-06-191-1/+1
| | | | | | | | | | gcc doesn't explode. Feel free to fix this correctly or whatever for gcc builds. This *should* quiesce tinderbox after r335347 for the gcc builds. Notes: svn path=/head/; revision=335379
* libnv: Add nvlist_append_*_array() family of functions.Mariusz Zaborski2018-06-183-0/+174
| | | | | | | | | | The nvlist_append_{bool,number,string,nvlist,descriptor}_array() functions allows to dynamically extend array stored in the nvlist. Submitted by: Mindaugas Rasiukevicius <rmind@netbsd.org> Notes: svn path=/head/; revision=335347
* libnv: clean parent in nvlist_array when removing it.Mariusz Zaborski2018-06-181-1/+3
| | | | | | | | | | When we are removing element form the nvlist we should also clean parent, because the array is not a part of the nvlist anymore. Submitted by: Mindaugas Rasiukevicius <rmind@netbsd.org> Notes: svn path=/head/; revision=335344
* libnv: Remove nvlist argument from cnvlist_{take,free}_* functions.Mariusz Zaborski2018-06-181-5/+11
| | | | | | | | | | | | | All information which are need for those operations is already stored in the cookie. We decided not to bump libnv version because this API is not used yet in the base system. Reviewed by: pjd Notes: svn path=/head/; revision=335343
* libnv: add const to cookies argumentsMariusz Zaborski2018-06-181-5/+5
| | | | | | | Pointed out by: pjd@ Notes: svn path=/head/; revision=335342
* libnv: change name of cookie from cookiep to cookie.Mariusz Zaborski2018-06-181-36/+36
| | | | | | | | | | The name was inconsistent with rest of the library. No functional change intended. Pointed out by: pjd@ Notes: svn path=/head/; revision=335341
* Add SPDX tags for nv(9).Mariusz Zaborski2018-01-277-0/+14
| | | | | | | MFC after: 2 weeks Notes: svn path=/head/; revision=328474
* libnv: Use mallocarray(9) for the nv_calloc.Pedro F. Giffuni2018-01-191-1/+1
| | | | Notes: svn path=/head/; revision=328164
* Introduce cnvlist_name() and cnvlist_type() functions.Mariusz Zaborski2017-10-261-0/+14
| | | | | | | | | | Those function can be used when we are iterating over nvlist to reduce amount of extra variables we need to declare. MFC after: 1 month Notes: svn path=/head/; revision=325019
* libnv: Fix strict-aliasing violation with cookieJilles Tjoelker2017-10-261-10/+14
| | | | | | | | | | | | | | | | | | | | In rS323851, some casts were adjusted in calls to nvlist_next() and nvlist_get_pararr() in order to make scan-build happy. I think these changes just confused scan-build into not reporting the strict-aliasing violation. For example, nvlist_xdescriptors() is causing nvlist_next() to write to its local variable nvp of type nvpair_t * using the lvalue *cookiep of type void *, which is not allowed. Given the APIs of nvlist_next(), nvlist_get_parent() and nvlist_get_pararr(), one possible fix is to create a local void *cookie in nvlist_xdescriptors() and other places, and to convert the value to nvpair_t * when necessary. This patch implements that fix. Reviewed by: oshogbo MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D12760 Notes: svn path=/head/; revision=325017
* Plug memory leak in case when nvlist allocation succeeds, but nvpairMariusz Zaborski2017-09-211-1/+1
| | | | | | | | | | | allocation fails. Submitted by: pjd@ MFC after: 1 month Sponsored by: Wheel Systems Notes: svn path=/head/; revision=323860
* Simplify the code by _not_ expecting success under 'fail'.Mariusz Zaborski2017-09-211-10/+10
| | | | | | | | | Submitted by: pjd@ and oshogbo@ MFC after: 1 month Sponsored by: Wheel Systems Notes: svn path=/head/; revision=323859
* IMHO it is possible that failure will be treated as success because we don'tMariusz Zaborski2017-09-211-16/+19
| | | | | | | | | | | | initialize nvp on every loop iteration and the code under 'fail'(!) label detects success by checking of nvp != NULL. Submitted by: pjd@ MFC after: 1 month Sponsored by: Wheel Systems Notes: svn path=/head/; revision=323858
* Free 'value' only once we are done freeing all individualMariusz Zaborski2017-09-211-1/+1
| | | | | | | | | | Submitted by: pjd@ MFC after: 1 month Found by: scan-build Sponsored by: Wheel Systems Notes: svn path=/head/; revision=323856
* Because nvp wasn't initialized on every loop iteration once we jumpedMariusz Zaborski2017-09-211-16/+22
| | | | | | | | | | | | | | | | | | to 'fail' on error it was treated as success, because nvp!=NULL. Fix this by not handling success under 'fail' label and by using separate variable for parent nvpair. If we succeeded to allocate nvlist, but failed to allocated nvpair we would leak nvls[ii] on return. Destroy it when we cannot allocate nvpair, before we goto fail. Submitted by: pjd@ and oshogbo@ (minor changes) Found by: scan-build MFC after: 1 month Sponsored by: Wheel Systems Notes: svn path=/head/; revision=323854
* Make the code consistent by always using 'fail' label.Mariusz Zaborski2017-09-212-30/+30
| | | | | | | | | Submitted by: pjd@ and oshogbo@ MFC after: 1 month Sponsored by: Wheel Systems Notes: svn path=/head/; revision=323853
* The 'while (array != NULL) { }' suggests scan-build that array may beMariusz Zaborski2017-09-211-2/+3
| | | | | | | | | | | | | | initially NULL, which is not possible. Change the loop to 'do {} while (array != NULL)' to satisfy scan-build and assert that array really cannot be NULL just in case. Submitted by: pjd@ Found by: scan-build MFC after: 1 month Sponsored by: Wheel Systems Notes: svn path=/head/; revision=323852
* Remove redundant initialization. Don't use variable - just return the value.Mariusz Zaborski2017-09-212-10/+5
| | | | | | | | | | | | Make scan-build happy by casting to 'void *' instead of 'void **'. Submitted by: pjd@ MFC after: 1 month Found by: scan-build and cppcheck Sponsored by: Wheel Systems Notes: svn path=/head/; revision=323851
* Fix style issue in the cnv API.Mariusz Zaborski2016-08-271-34/+38
| | | | | | | | Remove unused arguments in a macro. Remove unused typedef. Notes: svn path=/head/; revision=304909
* Add cnv API.Mariusz Zaborski2016-08-273-1/+195
| | | | | | | | | | | cnv API is a set of functions for managing name/value pairs by cookie. The cookie can be obtained by nvlist_next(), nvlist_get_parent() or nvlist_get_pararr() function. This patch also includes unit tests. Submitted by: Adam Starak <starak.adam@gmail.com> Notes: svn path=/head/; revision=304908
* Remove usage of _WITH_DPRINTFBaptiste Daroussin2016-07-301-1/+0
| | | | Notes: svn path=/head/; revision=303529
* Fix nvlist array memory leak.Mariusz Zaborski2016-07-171-2/+4
| | | | | | | | | | | | When we change nvl_array_next to NULL it means that we want to destroy or take nvlist_array. The nvpair, which stores next nvlist of nvlist_array element is no longer needed and can be freed. Submitted by: Adam Starak <starak.adam@gmail.com> MFC after: 1 week Notes: svn path=/head/; revision=302966
* Fix memory leak in the nvlist string array.Mariusz Zaborski2016-07-171-0/+1
| | | | | | | | Submitted by: Adam Starak <starak.adam@gmail.com> MFC after: 1 week Notes: svn path=/head/; revision=302965
generated by cgit v1.3 (git 2.53.0) at 2026-10-24 04:08:46 +0000