upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-02-19 02:30:08 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
opnsense-src/sys/dev/mps
History
Ed Maste 1289cbfc18 mpr/mps/mpt: verify cfg page ioctl lengths 
*_CFG_PAGE ioctl handlers in the mpr, mps, and mpt drivers allocated a
buffer of a caller-specified size, but copied to it a fixed size header.
Add checks that the size is at least the required minimum.

Note that the device nodes are owned by root:operator with 0640
permissions so the ioctls are not available to unprivileged users.

This change includes suggestions from scottl, markj and mav.

Two of the mpt cases were reported by Lucas Leong (@_wmliang_) of
Trend Micro Zero Day Initiative; scottl reported the third case in mpt.
Same issue found in mpr and mps after discussion with imp.

Reported by:	Lucas Leong (@_wmliang_), Trend Micro Zero Day Initiative
Reviewed by:	imp, mav
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D34692

(cherry picked from commit 8276c4149b)
(cherry picked from commit 0b29e1b9f9)

Approved by:	so
Security:	CVE-2022-23086
Security:	FreeBSD-SA-22:06.ioctl
2022-04-06 08:05:11 +02:00
..
mpi mps: clean up empty lines in .c and .h files 2020-09-01 22:07:00 +00:00
mps.c mpr/mps: Minor state machine fix 2021-09-02 20:34:22 -04:00
mps_config.c mps: clean up empty lines in .c and .h files 2020-09-01 22:07:00 +00:00
mps_ioctl.h mps: clean up empty lines in .c and .h files 2020-09-01 22:07:00 +00:00
mps_mapping.c mpr/mps(4): Make device mapping some more robust. 2021-05-24 10:43:39 -04:00
mps_mapping.h mps: clean up empty lines in .c and .h files 2020-09-01 22:07:00 +00:00
mps_pci.c Refine the busdma template interface. Provide tools for filling in fields 2020-09-14 05:58:12 +00:00
mps_sas.c mps(4): Fix unmatched devq release. 2022-01-06 14:03:38 -05:00
mps_sas.h Before issing the REMOVE_DEVICE command to the firmware, make sure that all 2020-02-25 04:27:23 +00:00
mps_sas_lsi.c Fix "set but not used" warnings in the mps driver. 2022-01-06 14:01:59 -05:00
mps_table.c Fix "set but not used" warnings in the mps driver. 2022-01-06 14:01:59 -05:00
mps_table.h sys/dev: further adoption of SPDX licensing ID tags. 2017-11-27 14:52:40 +00:00
mps_user.c mpr/mps/mpt: verify cfg page ioctl lengths 2022-04-06 08:05:11 +02:00
mpsvar.h Fix mpr(4) and mps(4) state transitions and a use-after-free panic. 2021-09-02 20:33:28 -04:00