Re: problem with gethostbyaddr() on OBSD 5.4?

2014-02-03 Thread Eric Faurot 
On Sun, Feb 02, 2014 at 03:12:36PM +0100, IMAP List Administration wrote:
 [I forgot to send this to the list]
 
 Hi Eric,
 
 On 02/01/2014 11:43 AM, Eric Faurot wrote:
  The following diff fixes the problems with the example IPs you gave us.
  - subsequent PTR records are now set as aliases in the hostent
  - need to accept '/' in dname labels (maybe others?)
 Since the code differs, I'm guessing your patch is for -current.
 
 We're running -stable. Could you possibly supply a patch for that?
 
 cheers,
 
 Rob Urban
 

Hi,

This is the diff against -stable.

Eric.

Index: asr_utils.c
===
RCS file: /cvs/src/lib/libc/asr/asr_utils.c,v
retrieving revision 1.8
diff -u -p -r1.8 asr_utils.c
--- asr_utils.c 12 Jul 2013 14:36:21 -  1.8
+++ asr_utils.c 3 Feb 2014 09:44:29 -
@@ -55,7 +55,7 @@ dname_check_label(const char *s, size_t 
return (-1);
 
for (l--; l; l--, s++)
-   if (!(isalnum(*s) || *s == '_' || *s == '-'))
+   if (!(isalnum(*s) || *s == '_' || *s == '-' || *s == '/'))
return (-1);
 
return (0);
Index: gethostnamadr_async.c
===
RCS file: /cvs/src/lib/libc/asr/gethostnamadr_async.c,v
retrieving revision 1.22
diff -u -p -r1.22 gethostnamadr_async.c
--- gethostnamadr_async.c   17 Jul 2013 07:43:23 -  1.22
+++ gethostnamadr_async.c   3 Feb 2014 09:44:30 -
@@ -504,8 +504,7 @@ hostent_from_packet(int reqtype, int fam
if (strcasecmp(rr.rr_dname, dname) != 0)
continue;
if (hostent_set_cname(h, rr.rr.ptr.ptrname, 1) == -1)
-   goto fail;
-   /* XXX See if we need MULTI_PTRS_ARE_ALIASES */
+   hostent_add_alias(h, rr.rr.ptr.ptrname, 1);
break;
 
case T_A:

replace libc on running system?

2014-02-03 Thread IMAP List Administration 
Hello Folks,

I've patched, recompiled and relinked libc. Are there any risks in installing it
on a running production system? Do I need to reboot immediately after 
installation?

cheers,

Rob Urban

Re: replace libc on running system?

2014-02-03 Thread Mark Kettenis 
 Date: Mon, 03 Feb 2014 12:02:16 +0100
 From: IMAP List Administration li...@y42.org
 
 Hello Folks,
 
 I've patched, recompiled and relinked libc. Are there any risks in
 installing it on a running production system? Do I need to reboot
 immediately after installation?

Depends on the patch...  But assuming it doesn't affect the ABI, there
should be no problems doing this.

You might want to schedule a reboot anyway.  Until you do, both the
old and the new libc will be in memory as aready running programs will
keep using the old copy.  Of course our libc is tiny compared to other
OSes.  But if memory is really tight...

Minimally you'll want to restart the pieces of software that depend on
the patch libc.  And if it is a security fix...

Re: problem with gethostbyaddr() on OBSD 5.4?

2014-02-03 Thread Robert Urban 
Hi Eric,

On 02/03/2014 10:48 AM, Eric Faurot wrote:
 On Sun, Feb 02, 2014 at 03:12:36PM +0100, IMAP List Administration wrote:
 [I forgot to send this to the list]

 Hi Eric,

 On 02/01/2014 11:43 AM, Eric Faurot wrote:
 The following diff fixes the problems with the example IPs you gave us.
 - subsequent PTR records are now set as aliases in the hostent
 - need to accept '/' in dname labels (maybe others?)
 Since the code differs, I'm guessing your patch is for -current.

 We're running -stable. Could you possibly supply a patch for that?

 cheers,

 Rob Urban

 Hi,

 This is the diff against -stable.

I've tested the patch, and I cannot reproduce the error.

Thanks for your help.

cheers,

Rob Urban

Fix for CVE-2012-3509 libiberty: integer overflow, leading to heap-buffer overflow

2014-02-03 Thread Sebastian Trahm 
Hello,

the following diff addresses CVE-2012-3509
(libiberty: integer overflow, leading to heap-buffer overflow).


Index: include/objalloc.h
===
RCS file: /cvs/src/gnu/lib/libiberty/include/objalloc.h,v
retrieving revision 1.1.1.3
diff -u -p -u -p -r1.1.1.3 objalloc.h
--- include/objalloc.h  27 May 2008 18:46:00 -  1.1.1.3
+++ include/objalloc.h  3 Feb 2014 13:24:24 -
@@ -91,7 +91,7 @@ extern void *_objalloc_alloc (struct obj
  if (__len == 0)   \
__len = 1;  \
  __len = (__len + OBJALLOC_ALIGN - 1) ~ (OBJALLOC_ALIGN - 1); \
- (__len = __o-current_space  \
+ (__len != 0  __len = __o-current_space\
   ? (__o-current_ptr += __len,\
 __o-current_space -= __len,   \
 (void *) (__o-current_ptr - __len))   \
Index: src/objalloc.c
===
RCS file: /cvs/src/gnu/lib/libiberty/src/objalloc.c,v
retrieving revision 1.4
diff -u -p -u -p -r1.4 objalloc.c
--- src/objalloc.c  27 May 2008 18:52:44 -  1.4
+++ src/objalloc.c  3 Feb 2014 13:24:24 -
@@ -112,14 +112,21 @@ objalloc_create (void)
 /* Allocate space from an objalloc structure.  */
 
 PTR
-_objalloc_alloc (struct objalloc *o, unsigned long len)
+_objalloc_alloc (struct objalloc *o, unsigned long original_len)
 {
+  unsigned long len = original_len;
+
   /* We avoid confusion from zero sized objects by always allocating
  at least 1 byte.  */
   if (len == 0)
 len = 1;
 
   len = (len + OBJALLOC_ALIGN - 1) ~ (OBJALLOC_ALIGN - 1);
+
+  /* CVE-2012-3509: Check for overflow in the alignment operation above
+   * and then malloc argument below. */
+  if (len + CHUNK_HEADER_SIZE  original_len)
+return NULL;
 
   if (len = o-current_space)
 {




No functional changes, therefore no bump of shlib_version.

Cheers,

Sebastian

[1] http://www.openwall.com/lists/oss-security/2012/08/29/3
[2] http://gcc.gnu.org/viewcvs/gcc?view=revisionrevision=191413

Re: Fix for CVE-2012-3509 libiberty: integer overflow, leading to heap-buffer overflow

2014-02-03 Thread Stuart Henderson 
Which license is this patch under?

On 3 February 2014 13:26:41 GMT+00:00, Sebastian Trahm ba...@schleifi.com 
wrote:
Hello,

the following diff addresses CVE-2012-3509
(libiberty: integer overflow, leading to heap-buffer overflow).


Index: include/objalloc.h
===
RCS file: /cvs/src/gnu/lib/libiberty/include/objalloc.h,v
retrieving revision 1.1.1.3
diff -u -p -u -p -r1.1.1.3 objalloc.h
--- include/objalloc.h 27 May 2008 18:46:00 -  1.1.1.3
+++ include/objalloc.h 3 Feb 2014 13:24:24 -
@@ -91,7 +91,7 @@ extern void *_objalloc_alloc (struct obj
  if (__len == 0)  \
__len = 1; \
  __len = (__len + OBJALLOC_ALIGN - 1) ~ (OBJALLOC_ALIGN - 1);\
- (__len = __o-current_space \
+ (__len != 0  __len = __o-current_space   \
   ? (__o-current_ptr += __len,   \
__o-current_space -= __len,   \
(void *) (__o-current_ptr - __len))   \
Index: src/objalloc.c
===
RCS file: /cvs/src/gnu/lib/libiberty/src/objalloc.c,v
retrieving revision 1.4
diff -u -p -u -p -r1.4 objalloc.c
--- src/objalloc.c 27 May 2008 18:52:44 -  1.4
+++ src/objalloc.c 3 Feb 2014 13:24:24 -
@@ -112,14 +112,21 @@ objalloc_create (void)
 /* Allocate space from an objalloc structure.  */
 
 PTR
-_objalloc_alloc (struct objalloc *o, unsigned long len)
+_objalloc_alloc (struct objalloc *o, unsigned long original_len)
 {
+  unsigned long len = original_len;
+
   /* We avoid confusion from zero sized objects by always allocating
  at least 1 byte.  */
   if (len == 0)
 len = 1;
 
   len = (len + OBJALLOC_ALIGN - 1) ~ (OBJALLOC_ALIGN - 1);
+
+  /* CVE-2012-3509: Check for overflow in the alignment operation
above
+   * and then malloc argument below. */
+  if (len + CHUNK_HEADER_SIZE  original_len)
+return NULL;
 
   if (len = o-current_space)
 {




No functional changes, therefore no bump of shlib_version.

Cheers,

Sebastian

[1] http://www.openwall.com/lists/oss-security/2012/08/29/3
[2] http://gcc.gnu.org/viewcvs/gcc?view=revisionrevision=191413

Re: responding to buttonpress ACPI event sent by KVM/Qemu (same behavior in v5.2)

2014-02-03 Thread Robert Urban 

On 02/03/2014 10:12 PM, Mike Larkin wrote:
 I'd run with acpi debug enabled, try to see if we are dropping an event.
On a 5.4 test system I compiled a new generic MP kernel with option ACPI_DEBUG
and booted it. I set up a serial console.

During boot there is a lot a ACPI debug output. I can make it available if
anyone would like to see it.

I then ran virsh shutdown guest. The guest froze without writing a single
character to the console.

Rob Urban

move p_comm into process

2014-02-03 Thread Ted Unangst 
No need for every thread to have its own name, right?

(And can I say, wow, is every arch except i386 generous with the
debug output?)

Index: arch/alpha/alpha/interrupt.c
===
RCS file: /cvs/src/sys/arch/alpha/alpha/interrupt.c,v
retrieving revision 1.31
diff -u -p -r1.31 interrupt.c
--- arch/alpha/alpha/interrupt.c15 Apr 2011 20:40:03 -  1.31
+++ arch/alpha/alpha/interrupt.c4 Feb 2014 00:57:42 -
@@ -375,7 +375,7 @@ fatal:
printf(curproc = %p\n, curproc);
if (curproc != NULL)
printf(pid = %d, comm = %s\n, curproc-p_pid,
-   curproc-p_comm);
+   curproc-p_p-ps_comm);
printf(\n);
panic(machine check);
 }
Index: arch/alpha/alpha/trap.c
===
RCS file: /cvs/src/sys/arch/alpha/alpha/trap.c,v
retrieving revision 1.65
diff -u -p -r1.65 trap.c
--- arch/alpha/alpha/trap.c 6 Jan 2014 20:27:44 -   1.65
+++ arch/alpha/alpha/trap.c 4 Feb 2014 00:57:42 -
@@ -209,7 +209,7 @@ printtrap(a0, a1, a2, entry, framep, isf
printf(curproc= %p\n, curproc);
if (curproc != NULL)
printf(pid = %d, comm = %s\n, curproc-p_pid,
-  curproc-p_comm);
+  curproc-p_p-ps_comm);
printf(\n);
 }
 #endif /* DEBUG */
@@ -452,7 +452,7 @@ do_fault:
typ = SEGV_MAPERR;
if (rv == ENOMEM) {
printf(UVM: pid %u (%s), uid %u killed: 
-  out of swap\n, p-p_pid, p-p_comm,
+  out of swap\n, p-p_pid, 
p-p_p-ps_comm,
   p-p_cred  p-p_ucred ?
   p-p_ucred-cr_uid : -1);
i = SIGKILL;
@@ -968,7 +968,7 @@ unaligned_fixup(va, opcode, reg, p)
if (doprint) {
uprintf(
pid %u (%s): unaligned access: va=0x%lx pc=0x%lx ra=0x%lx op=,
-   p-p_pid, p-p_comm, va,
+   p-p_pid, p-p_p-ps_comm, va,
p-p_md.md_tf-tf_regs[FRAME_PC] - 4,
p-p_md.md_tf-tf_regs[FRAME_RA]);
uprintf(selected_tab-type,opcode);
Index: arch/amd64/amd64/machdep.c
===
RCS file: /cvs/src/sys/arch/amd64/amd64/machdep.c,v
retrieving revision 1.173
diff -u -p -r1.173 machdep.c
--- arch/amd64/amd64/machdep.c  5 Jan 2014 20:23:56 -   1.173
+++ arch/amd64/amd64/machdep.c  4 Feb 2014 00:57:42 -
@@ -552,7 +552,7 @@ sendsig(sig_t catcher, int sig, int mask
 #ifdef DEBUG
if ((sigdebug  SDB_FOLLOW)  (!sigpid || p-p_pid == sigpid))
printf(sendsig: %s[%d] sig %d catcher %p\n,
-   p-p_comm, p-p_pid, sig, catcher);
+   p-p_p-ps_comm, p-p_pid, sig, catcher);
 #endif
 
bcopy(tf, ksc, sizeof(*tf));
Index: arch/amd64/amd64/trap.c
===
RCS file: /cvs/src/sys/arch/amd64/amd64/trap.c,v
retrieving revision 1.32
diff -u -p -r1.32 trap.c
--- arch/amd64/amd64/trap.c 31 Dec 2012 06:46:13 -  1.32
+++ arch/amd64/amd64/trap.c 4 Feb 2014 00:57:42 -
@@ -246,7 +246,7 @@ copyfault:
case T_NMI|T_USER:
 #ifdef TRAP_SIGDEBUG
printf(pid %d (%s): BUS at rip %lx addr %lx\n,
-   p-p_pid, p-p_comm, frame-tf_rip, rcr2());
+   p-p_pid, p-p_p-ps_comm, frame-tf_rip, rcr2());
frame_dump(frame);
 #endif
sv.sival_ptr = (void *)frame-tf_rip;
@@ -270,7 +270,7 @@ copyfault:
case T_FPOPFLT|T_USER:  /* coprocessor operand fault */
 #ifdef TRAP_SIGDEBUG
printf(pid %d (%s): ILL at rip %lx addr %lx\n,
-   p-p_pid, p-p_comm, frame-tf_rip, rcr2());
+   p-p_pid, p-p_p-ps_comm, frame-tf_rip, rcr2());
frame_dump(frame);
 #endif
sv.sival_ptr = (void *)frame-tf_rip;
@@ -404,7 +404,7 @@ faultcommon:
}
if (error == ENOMEM) {
printf(UVM: pid %d (%s), uid %d killed: out of swap\n,
-  p-p_pid, p-p_comm,
+  p-p_pid, p-p_p-ps_comm,
   p-p_cred  p-p_ucred ?
   (int)p-p_ucred-cr_uid : -1);
sv.sival_ptr = (void *)fa;
@@ -412,7 +412,7 @@ faultcommon:
} else {
 #ifdef TRAP_SIGDEBUG
printf(pid %d (%s): SEGV at rip %lx addr %lx\n,
-   p-p_pid, p-p_comm, frame-tf_rip, fa);
+   p-p_pid, p-p_p-ps_comm, frame-tf_rip, fa);
frame_dump(frame);
 #endif

Re: move p_comm into process

2014-02-03 Thread Philip Guenther 
On Mon, Feb 3, 2014 at 5:09 PM, Ted Unangst t...@tedunangst.com wrote:
 No need for every thread to have its own name, right?

pthread_set_name_np()?  Would be nice to have that reflect into ps H
output if it's used in real programs.  Linux calls that function
pthread_setname_np(), so maybe it's actually in use.

Also, I was thinking of making all the kernel threads (reaper,
usbatsk, idleN, acpi, etc) into threads of proc0 instead of full
processes, saving the process structures, but that only works if you
can still see their names in the output of ps xak.


Philip Guenther