Author: delphij
Date: Thu Aug 10 06:59:07 2017
New Revision: 322342
URL: https://svnweb.freebsd.org/changeset/base/322342
Log:
Fix OpenSSH Denial of Service vulnerability. [SA-17:06]
Fix VNET kernel panic with asynchronous I/O. [EN-17:07]
Fix pf(4) housekeeping thread causes kernel panic. [EN-17:08]
Approved by: so
Modified:
releng/11.1/UPDATING
releng/11.1/crypto/openssh/auth-passwd.c
releng/11.1/sys/conf/newvers.sh
releng/11.1/sys/kern/sys_socket.c
releng/11.1/sys/netpfil/pf/pf.c
Modified: releng/11.1/UPDATING
==============================================================================
--- releng/11.1/UPDATING Thu Aug 10 06:36:37 2017 (r322341)
+++ releng/11.1/UPDATING Thu Aug 10 06:59:07 2017 (r322342)
@@ -16,6 +16,16 @@ from older versions of FreeBSD, try WITHOUT_CLANG and
the tip of head, and then rebuild without this option. The bootstrap process
from older version of current across the gcc/clang cutover is a bit fragile.
+20170810 p1 FreeBSD-SA-17:06.openssh
+ FreeBSD-EN-17:07.vnet
+ FreeBSD-EN-17:08.pf
+
+ Fix OpenSSH Denial of Service vulnerability. [SA-17:06]
+
+ Fix VNET kernel panic with asynchronous I/O. [EN-17:07]
+
+ Fix pf(4) housekeeping thread causes kernel panic. [EN-17:08]
+
20170725:
11.1-RELEASE.
Modified: releng/11.1/crypto/openssh/auth-passwd.c
==============================================================================
--- releng/11.1/crypto/openssh/auth-passwd.c Thu Aug 10 06:36:37 2017
(r322341)
+++ releng/11.1/crypto/openssh/auth-passwd.c Thu Aug 10 06:59:07 2017
(r322342)
@@ -66,6 +66,8 @@ extern login_cap_t *lc;
#define DAY (24L * 60 * 60) /* 1 day in seconds */
#define TWO_WEEKS (2L * 7 * DAY) /* 2 weeks in seconds */
+#define MAX_PASSWORD_LEN 1024
+
void
disable_forwarding(void)
{
@@ -86,6 +88,9 @@ auth_password(Authctxt *authctxt, const char *password
#if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
static int expire_checked = 0;
#endif
+
+ if (strlen(password) > MAX_PASSWORD_LEN)
+ return 0;
#ifndef HAVE_CYGWIN
if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
Modified: releng/11.1/sys/conf/newvers.sh
==============================================================================
--- releng/11.1/sys/conf/newvers.sh Thu Aug 10 06:36:37 2017
(r322341)
+++ releng/11.1/sys/conf/newvers.sh Thu Aug 10 06:59:07 2017
(r322342)
@@ -44,7 +44,7 @@
TYPE="FreeBSD"
REVISION="11.1"
-BRANCH="RELEASE"
+BRANCH="RELEASE-p1"
if [ -n "${BRANCH_OVERRIDE}" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
Modified: releng/11.1/sys/kern/sys_socket.c
==============================================================================
--- releng/11.1/sys/kern/sys_socket.c Thu Aug 10 06:36:37 2017
(r322341)
+++ releng/11.1/sys/kern/sys_socket.c Thu Aug 10 06:59:07 2017
(r322342)
@@ -675,6 +675,7 @@ soaio_process_sb(struct socket *so, struct sockbuf *sb
{
struct kaiocb *job;
+ CURVNET_SET(so->so_vnet);
SOCKBUF_LOCK(sb);
while (!TAILQ_EMPTY(&sb->sb_aiojobq) && soaio_ready(so, sb)) {
job = TAILQ_FIRST(&sb->sb_aiojobq);
@@ -698,6 +699,7 @@ soaio_process_sb(struct socket *so, struct sockbuf *sb
ACCEPT_LOCK();
SOCK_LOCK(so);
sorele(so);
+ CURVNET_RESTORE();
}
void
Modified: releng/11.1/sys/netpfil/pf/pf.c
==============================================================================
--- releng/11.1/sys/netpfil/pf/pf.c Thu Aug 10 06:36:37 2017
(r322341)
+++ releng/11.1/sys/netpfil/pf/pf.c Thu Aug 10 06:59:07 2017
(r322342)
@@ -129,6 +129,8 @@ VNET_DEFINE(int, pf_tcp_secret_init);
#define V_pf_tcp_secret_init VNET(pf_tcp_secret_init)
VNET_DEFINE(int, pf_tcp_iss_off);
#define V_pf_tcp_iss_off VNET(pf_tcp_iss_off)
+VNET_DECLARE(int, pf_vnet_active);
+#define V_pf_vnet_active VNET(pf_vnet_active)
/*
* Queue for pf_intr() sends.
@@ -1439,6 +1441,12 @@ pf_purge_thread(void *unused __unused)
pf_end_threads++;
wakeup(pf_purge_thread);
kproc_exit(0);
+ }
+
+ /* Wait while V_pf_default_rule.timeout is initialized. */
+ if (V_pf_vnet_active == 0) {
+ CURVNET_RESTORE();
+ continue;
}
/* Process 1/interval fraction of the state table every run. */
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
