opnsense-src/sys
Pierre Pronchery 82c41c9ffc umb: avoid wild pointer dereference in umb_decap()
When processing messages produced by the USB device, umb_decap() trusts
ptroff and later dlen and doff with pointer arithmetic, without
sufficient sanity checks. The resulting pointer address may be outside
of the valid boundary, causing the wrong memory to be copied or a page
fault.

This fix from Gerhard Roth was obtained after coordination upstream with
OpenBSD. It converts the variables to 64-bit integers, which should
mitigate the risk of overflows.

PR:             284920
Reported by:    Robert Morris <rtm@lcs.mit.edu>
Approved by:	philip (mentor)
Sponsored by:   The FreeBSD Foundation
2025-05-29 15:07:57 +02:00
..
amd64 amd64: revert unintended changes in ia32_exception.S 2025-05-28 15:02:23 +03:00
arm Restore #include <sys/devmap.h> 2025-05-29 12:14:25 +02:00
arm64 arm64: Add more PMCR_EL0 fields 2025-05-27 20:55:21 +01:00
bsm
cam scsi/da: Only send SYNC CACHE for devices with mode page 8 2025-05-07 15:36:55 -06:00
cddl dtrace: Add compiler barriers around updates to per-CPU flags 2025-05-28 21:05:16 +00:00
compat LinuxKPI: add struct_group_tagged() 2025-05-28 10:42:58 +00:00
conf mac_do(4): allow compiling into kernel 2025-05-22 17:59:32 +01:00
contrib iwlwifi: update script to extract firmware/chipset generations/flavors/.. 2025-05-13 00:04:46 +00:00
crypto openssl: update ASM and version info for 3.0.16 import 2025-03-13 23:42:02 -07:00
ddb
dev umb: avoid wild pointer dereference in umb_decap() 2025-05-29 15:07:57 +02:00
dts dts: fix RT-AC58U to match the updated device tree name/alias changes. 2025-04-07 20:45:40 -07:00
fs namei: Fix cn_flags width in various places 2025-05-27 13:29:14 +00:00
gdb
geom sysctl(9): Ease exporting struct sizes; Discourage doing that 2025-05-07 12:13:40 +02:00
gnu
i386 i386: replace tailq pointers with iterators 2025-04-20 23:05:48 -05:00
isa
kern vfs: Don't clobber namei flags in vn_open_cred() 2025-05-28 15:41:53 +00:00
kgssapi crypto: Remove uses of CRYPTO_F_DONE 2025-05-09 00:29:23 +00:00
libkern
modules buildkernel: fix build for kernels without VIMAGE 2025-05-26 08:23:37 -07:00
net pf: remove XXX from the comments marking "holes" in the ioctls 2025-05-29 09:14:58 +02:00
net80211 net80211: make sure to not start a BGSCAN if not enabled 2025-05-28 10:42:58 +00:00
netgraph ng_sample: fix style nits 2025-05-16 21:29:47 +01:00
netinet ddb: add show all tcpcbs 2025-05-28 12:25:26 +02:00
netinet6 icmp6: fix use-after-reference-release 2025-05-27 11:47:43 +02:00
netipsec pfkey2: use correct value for a key length 2025-03-06 15:18:59 +03:00
netlink jail: add allow.routing jail permission 2025-05-12 23:13:18 +01:00
netpfil pf: remove unused 'dir' argument in pf_reassemble() 2025-05-29 13:54:55 +02:00
netsmb
nfs
nfsclient
nfsserver
nlm
ofed ofed: jiffies is unsigned long 2025-04-29 13:53:40 +00:00
opencrypto crypto: Remove uses of CRYPTO_F_DONE 2025-05-09 00:29:23 +00:00
powerpc powerpc: Enable VIMAGE on more kernel configs 2025-05-20 12:09:29 +08:00
riscv subr_devmap: Reduce the use of the static devmap 2025-05-02 16:39:04 +01:00
rpc
security MAC/do: Fix a too stringent debug assertion for a target of 'uid=*' 2025-05-27 11:20:07 +02:00
sys Bump __FreeBSD_version and provide P_OSREL_TLSBASE for amd64 set_tlsbase 2025-05-28 14:11:23 +03:00
teken
tests
tools vnode_if: Remove some branching around SDT probes in VOP wrappers 2025-05-22 14:37:49 +00:00
ufs ufs_aclcheck(): accurately dereference vp->v_mount 2025-03-22 01:40:00 +02:00
vm vm_object: use lookup_range in page_clean_flush 2025-05-28 00:33:43 -05:00
x86 amd64: switch to amd64_set_tlsbase to set tls base 2025-05-28 14:11:23 +03:00
xdr
xen
Makefile
README.md

FreeBSD Kernel Source:

This directory contains the source files and build glue that make up the FreeBSD kernel and its modules, including both original and contributed software.

Kernel configuration files are located in the conf/ subdirectory of each architecture. GENERIC is the configuration used in release builds. NOTES contains documentation of all possible entries. LINT is a compile-only configuration used to maximize build coverage and detect regressions.

Documentation:

Source code documentation is maintained in a set of man pages, under section 9. These pages are located in share/man/man9, from the top-level of the src tree. Consult intro(9) for an overview of existing pages.

Some additional high-level documentation of the kernel is maintained in the Architecture Handbook.

Source Roadmap:

Directory Description
amd64 AMD64 (64-bit x86) architecture support
arm 32-bit ARM architecture support
arm64 64-bit ARM (AArch64) architecture support
cam Common Access Method storage subsystem - cam(4) and ctl(4)
cddl CDDL-licensed optional sources such as DTrace
conf kernel build glue
compat Linux compatibility layer, FreeBSD 32-bit compatibility
contrib 3rd-party imported software such as OpenZFS
crypto crypto drivers
ddb interactive kernel debugger - ddb(4)
fs most filesystems, excluding UFS, NFS, and ZFS
dev device drivers and other arch independent code
gdb kernel remote GDB stub - gdb(4)
geom GEOM framework - geom(4)
i386 i386 (32-bit x86) architecture support
kern main part of the kernel
libkern libc-like and other support functions for kernel use
modules kernel module infrastructure
net core networking code
net80211 wireless networking (IEEE 802.11) - net80211(4)
netgraph graph-based networking subsystem - netgraph(4)
netinet IPv4 protocol implementation - inet(4)
netinet6 IPv6 protocol implementation - inet6(4)
netipsec IPsec protocol implementation - ipsec(4)
netpfil packet filters - ipfw(4), pf(4), and ipfilter(4)
opencrypto OpenCrypto framework - crypto(7)
powerpc PowerPC/POWER (32 and 64-bit) architecture support
riscv 64-bit RISC-V architecture support
security security facilities - audit(4) and mac(4)
sys kernel headers
tests kernel unit tests
ufs Unix File System - ffs(4)
vm virtual memory system
x86 code shared by AMD64 and i386 architectures