Add today's advisories.

Approved by:	so
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
Gordon Tetlow 2018-05-08 17:24:52 +00:00
parent 1a92f8ff7f
commit 73d16f03cd
Notes: svn2git 2020-12-08 03:00:23 +00:00
svn path=/head/; revision=51632
15 changed files with 2297 additions and 0 deletions

View file

@ -0,0 +1,152 @@
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-18:05.mem Errata Notice
The FreeBSD Project
Topic: Multiple small kernel memory disclosures
Category: core
Module: kernel
Announced: 2018-05-08
Credits: Ilja van Sprundel, IOActive
Vlad Tsyrklevich
Affects: All supported versions of FreeBSD.
Corrected: 2018-04-08 20:50:16 UTC (stable/11, 11.1-STABLE)
2018-05-08 17:14:54 UTC (releng/11.1, 11.1-RELEASE-p10)
2018-04-09 12:55:09 UTC (stable/10, 10.4-STABLE)
2018-05-08 17:14:54 UTC (releng/10.4, 10.4-RELEASE-p9)
CVE Name: CVE-2018-6920, CVE-2018-6921
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
FreeBSD includes drivers for Atheros wireless interfaces, a TCP network
stack, and the ability to execute Linux binaries.
II. Problem Description
Due to insufficient initialization of memory copied to userland in the
components described above small amounts of kernel memory may be disclosed
to userland processes.
The disclosure in the Atheros wireless driver and Linux subsystem applies to
both FreeBSD 10.x and 11.x (CVE-2018-6920).
The disclosure in the TCP network stack was introduced in 11.0. As such,
only FreeBSD 11.x is affected by this issue (CVE-2018-6921).
III. Impact
A user who can access these drivers, use TCP sockets, or execute Linux
binaries may be able to read the contents of small portions of kernel memory.
Such memory might contain sensitive information, such as portions of the file
cache or terminal buffers. This information might be directly useful, or it
might be leveraged to obtain elevated privileges in some way; for example,
a terminal buffer might include a user-entered password.
IV. Workaround
No workaround is available.
V. Solution
Perform one of the following:
1) Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.
Afterward, reboot the system.
2) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
Afterward, reboot the system.
3) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 11.1]
# fetch https://security.FreeBSD.org/patches/EN-18:05/mem.11.1.patch
# fetch https://security.FreeBSD.org/patches/EN-18:05/mem.11.1.patch.asc
# gpg --verify mem.11.1.patch.asc
[FreeBSD 10.4]
# fetch https://security.FreeBSD.org/patches/EN-18:05/mem.10.4.patch
# fetch https://security.FreeBSD.org/patches/EN-18:05/mem.10.4.patch.asc
# gpg --verify mem.10.4.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/10/ r332321
releng/10.4/ r333372
stable/11/ r332303
releng/11.1/ r333372
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6920>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6921>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-18:05.mem.asc>
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrx3F5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cLEJw/+O78dItjByrV33QHG6FG99Sk2tMvYJaD5jmM7qUiV2TiumFz4n8a3IjDe
kEmH68jkHxkSvWHvpOKMYx/CzzGG1UkMQvrFseGO6d/azZMqY4V3WqXeKcD6lwLI
qggFdIBDr2ltGQ19jLuD8ucfuyC8DurdhiEzn1s7e2YjpPaCgNSc9kHf/+Ez/MBu
v9ozlq/uS9+tLWHCoY6r4WFXWBrT96LFs9O+5TMVXZ+1ZuIvj4/2y+7HtgJalt85
5+bce0+qFdmk/gpcw7SQOZ1ngeXPWi9fDOv7LR+YkDaHcpJP9sXp9Ej2Tro97CMK
oQ0QGiJ+h1iGuYIw76chchZ5mK+UEVSbdxK70fpPC1zi+g8l0smVSpOs8oNFGX0m
F0pHhIz3LwMMDyZgJsEMUIkBF7nbKS8Mc+noq9DOaOjZjb0yyBFbc8s82LIdbOhO
IIJftNF1NSlH4tKJtFdet/TrxHX/UZ0xp52SHev+U3c3gXaoP4EUHQ71R/lnlyJc
R+H6G/xZjcsNrklKgJJMV+5znKbjDaqavaaAxo17eRqLG/M4ZIac3xzqJUyeuUPY
RnErPTRQzGL4C9CldxjIfI+iY3f2uTsNclzonV98kcLxbRdMsNIybUV6mNBYVmlx
4A6IN3zP1+bsbjOdZMhpAUIjsflj/KzdF/f4/BjoCgBv3O030ec=
=jxlW
-----END PGP SIGNATURE-----

View file

@ -0,0 +1,147 @@
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-18:06.tzdata Errata Notice
The FreeBSD Project
Topic: Timezone database information update
Category: contrib
Module: zoneinfo
Announced: 2018-05-08
Credits: Philip Paeps
Affects: All supported versions of FreeBSD.
Corrected: 2018-05-07 06:58:19 UTC (stable/11, 11.2-PRERELEASE)
2018-05-08 17:18:24 UTC (releng/11.1, 11.1-RELEASE-p10)
2018-05-07 07:02:26 UTC (stable/10, 10.4-STABLE)
2018-05-08 17:18:24 UTC (releng/10.4, 10.4-RELEASE-p9)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
The tzsetup(8) program allows the user to specify the default local timezone.
Based on the selected timezone, tzsetup(8) copies one of the files from
/usr/share/zoneinfo to /etc/localtime. This file actually controls the
conversion.
II. Problem Description
Several changes in Daylight Savings Time happened after previous FreeBSD
releases were released that would affect many people who live in different
countries. Because of these changes, the data in the zoneinfo files need to
be updated, and if the local timezone on the running system is affected,
tzsetup(8) needs to be run so the /etc/localtime is updated.
III. Impact
An incorrect time will be displayed on a system configured to use one of the
affected timezones if the /usr/share/zoneinfo and /etc/localtime files are
not updated, and all applications on the system that rely on the system time,
such as cron(8) and syslog(8), will be affected.
IV. Workaround
The system administrator can install an updated timezone database from the
misc/zoneinfo port and run tzsetup(8) to get the timezone database corrected.
Applications that store and display times in Coordinated Universal Time (UTC)
are not affected.
V. Solution
Please note that some third party software, for instance PHP, Ruby, Java and
Perl, may be using different zoneinfo data source, in such cases this
software must be updated separately. For software packages that is installed
via binary packages, they can be upgraded by executing `pkg upgrade'.
Following the instructions in this Errata Notice will update all of the
zoneinfo files to be the same as what was released with FreeBSD release.
Perform one of the following:
1) Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date. Restart all the affected
applications and daemons, or reboot the system.
2) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
Restart all the affected applications and daemons, or reboot the system.
3) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-18:06/tzdata-2018e.patch
# fetch https://security.FreeBSD.org/patches/EN-18:06/tzdata-2018e.patch.asc
# gpg --verify tzdata-2018e.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all the affected applications and daemons, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/10/ r333313
releng/10.4/ r333375
stable/11/ r333312
releng/11.1/ r333375
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-18:06.tzdata.asc>
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrx3G1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cIzdg//a6Vn9B/eW4na7jAcX4rUCUJGBFE1A4MhX4NGULx+L4v6qkcdj4O6CWYR
rbqNRzEtb5oF0We9K0XyekigmOVmb5TwDXHbjiaw13DrLWM4WhEAerRP04DrDV7k
31SGAq92L3oP4u8FrxwdtKZ2TY5naH/3GdGEL0JJmUaqUSrtLeiOvqVwCKZIy7i9
Q4DqQh7cEtBK5J8V+VqqbKNKOTPKS0uH27UAjzPhTc+GbZ4YRnD4YKVfNZMEDmiy
5TgXJrVOX+eJZlB1jgZXJY38wZtQELbs+2I2haNvzKz3Ypt7Rtan9MxAWkBkC+g6
/tbiJFYaJ5GC0CTBymBa8gm5oqvpWzb3h3kNpld4SDyO1iDcIcD7/+VqnNoFynVa
Fgf/icLc3Ck48n0ZZQlkGk22kTmBwe69p6QLnL5cuDbm3ZpRM/+1GjguG2Ow5eYD
Y6p6eMozALZh2JdHdxAtKEuSfc03UOMcEu2kBtVE/XtoJqPb+2SmaSRvXmMiio2E
TPjjdAzUUITDcESmyJLmHoqwHR40i2+ZSwH6BbD/1qeoH7PSXS+/Nh/wv2KEsC0S
tbAYiwuj4uDlgPIPm0tr2xDB+2BaSVe/0AituXyzFQVnrNJHisLrk0tZ7Y3WmN0B
Fn/5LIRGjT51Sw/0D0XpedwcdWoUQ9vz/FpoC6xQDcaXhW/ViDo=
=0QUF
-----END PGP SIGNATURE-----

View file

@ -0,0 +1,141 @@
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-18:06.debugreg Security Advisory
The FreeBSD Project
Topic: Mishandling of x86 debug exceptions
Category: core
Module: kernel
Announced: 2018-05-08
Credits: Nick Peterson, Everdox Tech LLC
https://www.linkedin.com/in/everdox
Andy Lutomirski
Affects: All supported versions of FreeBSD.
Corrected: 2018-05-08 17:03:33 UTC (stable/11, 11.2-PRERELEASE)
2018-05-08 17:12:10 UTC (releng/11.1, 11.1-RELEASE-p10)
2018-05-08 17:05:39 UTC (stable/10, 10.4-STABLE)
2018-05-08 17:12:10 UTC (releng/10.4, 10.4-RELEASE-p9)
CVE Name: CVE-2018-8897
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
On x86 architecture systems, the stack is represented by the combination of
a stack segment and a stack pointer, which must remain in sync for proper
operation. Instructions related to manipulating the stack segment have
special handling to facilitate consistency with changes to the stack pointer.
II. Problem Description
The MOV SS and POP SS instructions inhibit debug exceptions until the
instruction boundary following the next instruction. If that instruction is
a system call or similar instruction that transfers control to the operating
system, the debug exception will be handled in the kernel context instead of
the user context.
III. Impact
An authenticated local attacker may be able to read sensitive data in kernel
memory, control low-level operating system functions, or may panic the
system.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
using either a binary or source code patch, and then reboot.
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
And reboot.
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 11.1]
# fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.11.1.patch
# fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.11.1.patch.asc
# gpg --verify debugreg.11.1.patch.asc
[FreeBSD 10.4]
# fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.10.4.patch
# fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.10.4.patch.asc
# gpg --verify debugreg.10.4.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile and install your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/10/ r333370
releng/10.4/ r333371
stable/11/ r333369
releng/11.1/ r333371
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8897>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-18:06.debugreg.asc>
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrx3HhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cK/jhAAmPPCFZRMvbyG0VBCBqo5COFZ/32IMOWFDGMlsSi+CEgcGM51SzYZi97c
zsT/2RgMsvBdggk41wvXqp1gKxgIbJe22af7l+D18e6rDEesueJqSiizcHmfGQul
X+ZRUkFxTkCNz0Ajp4clqbavuHNiCmiKmH/0X8LMk31SXIVE3oH0Pphf0W8qJqxz
4k2nvc6NoPWEMVA0rsj3n6sB0NhvV1ddLLmGpoDgedSyz77PCDgWGMoh5ny5sY12
tHNB1r+gL624Y0l8xoyVJP0Snk0emzeQQ5HOTa8DRIwD/a0Uxy+xKcvDMorW9U6M
zsxrMs9EwSJYpwLxsQ/YVTgFvyQbkHXFXg56hxqUvnnEEahGfF47d/9x2lyzDr8r
H+ncl9a+PfOCJ5OcwkjzorQv+Pq65JFlc15bxLS+zyU4g6yJDnHdk7Azbc60Uwq/
chauKmosm1I1CVH60JG00rmvoiX7b5ZRdEGEzAFt4XIX+EuXPnI84C5DxiD1YG+3
n7IygNZNGtGfIrNhWEn2VK+VGzFEm2p4RkreWbGwrWQIxfd5gOJxvjAPSwjgy5rl
dwRW7bMzowIGnrlzCF18Qc2xnFD31JPYDdsI+Fa8d1YkCVWRZ79VX57Locw50/de
c5nZRJGk4AQ1lXxkNTkxWnstfb/q8fBVPkIEQKVHpVnGiI/pQpQ=
=Oyxs
-----END PGP SIGNATURE-----

View file

@ -0,0 +1,115 @@
--- sys/compat/linux/linux_ioctl.c.orig
+++ sys/compat/linux/linux_ioctl.c
@@ -246,6 +246,7 @@
} else if ((args->cmd & 0xffff) == LINUX_HDIO_GET_GEO_BIG) {
struct linux_hd_big_geometry hdbg;
+ memset(&hdbg, 0, sizeof(hdbg));
hdbg.cylinders = fwcylinders;
hdbg.heads = fwheads;
hdbg.sectors = fwsectors;
@@ -2426,6 +2427,7 @@
printf("%s(): ioctl %d on %.*s\n", __func__,
args->cmd & 0xffff, LINUX_IFNAMSIZ, lifname);
#endif
+ memset(ifname, 0, sizeof(ifname));
ifp = ifname_linux_to_bsd(td, lifname, ifname);
if (ifp == NULL)
return (EINVAL);
--- sys/compat/linux/linux_ipc.c.orig
+++ sys/compat/linux/linux_ipc.c
@@ -516,6 +516,9 @@
register_t rval;
int cmd, error;
+ memset(&linux_seminfo, 0, sizeof(linux_seminfo));
+ memset(&linux_semid, 0, sizeof(linux_semid));
+
switch (args->cmd & ~LINUX_IPC_64) {
case LINUX_IPC_RMID:
cmd = IPC_RMID;
@@ -661,6 +664,8 @@
struct l_msqid_ds linux_msqid;
struct msqid_ds bsd_msqid;
+ memset(&linux_msqid, 0, sizeof(linux_msqid));
+
bsd_cmd = args->cmd & ~LINUX_IPC_64;
switch (bsd_cmd) {
case LINUX_IPC_INFO:
@@ -667,6 +672,7 @@
case LINUX_MSG_INFO: {
struct l_msginfo linux_msginfo;
+ memset(&linux_msginfo, 0, sizeof(linux_msginfo));
/*
* XXX MSG_INFO uses the same data structure but returns different
* dynamic counters in msgpool, msgmap, and msgtql fields.
@@ -789,6 +795,10 @@
struct shmid_ds bsd_shmid;
int error;
+ memset(&linux_shm_info, 0, sizeof(linux_shm_info));
+ memset(&linux_shmid, 0, sizeof(linux_shmid));
+ memset(&linux_shminfo, 0, sizeof(linux_shminfo));
+
switch (args->cmd & ~LINUX_IPC_64) {
case LINUX_IPC_INFO: {
--- sys/dev/ath/if_ath_btcoex.c.orig
+++ sys/dev/ath/if_ath_btcoex.c
@@ -321,7 +321,7 @@
* pointer for us to use below in reclaiming the buffer;
* may want to be more defensive.
*/
- outdata = malloc(outsize, M_TEMP, M_NOWAIT);
+ outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) {
error = ENOMEM;
goto bad;
@@ -330,6 +330,7 @@
switch (id) {
default:
error = EINVAL;
+ goto bad;
}
if (outsize < ad->ad_out_size)
ad->ad_out_size = outsize;
--- sys/dev/ath/if_ath_lna_div.c.orig
+++ sys/dev/ath/if_ath_lna_div.c
@@ -185,7 +185,7 @@
* pointer for us to use below in reclaiming the buffer;
* may want to be more defensive.
*/
- outdata = malloc(outsize, M_TEMP, M_NOWAIT);
+ outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) {
error = ENOMEM;
goto bad;
@@ -194,6 +194,7 @@
switch (id) {
default:
error = EINVAL;
+ goto bad;
}
if (outsize < ad->ad_out_size)
ad->ad_out_size = outsize;
--- sys/dev/ath/if_ath_spectral.c.orig
+++ sys/dev/ath/if_ath_spectral.c
@@ -210,7 +210,7 @@
* pointer for us to use below in reclaiming the buffer;
* may want to be more defensive.
*/
- outdata = malloc(outsize, M_TEMP, M_NOWAIT);
+ outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) {
error = ENOMEM;
goto bad;
@@ -273,6 +273,7 @@
break;
default:
error = EINVAL;
+ goto bad;
}
if (outsize < ad->ad_out_size)
ad->ad_out_size = outsize;

View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrxvPRfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cL+ag/9G31jTLcccP2zEVMkQImlpbok+NQ6S/68DSgLfyht72mBR+Auhr+uN6i4
9Rd3+UDwA5ZLOYt7QcZpV5xAJKAp9JtV8gNA0TFpWsRY2OYzDXL2EbyVonhutib5
X5a0ClXjMOP99OZTWKMxQvLMZOa4p6DLOxZZfHyqbKdiDVOQCvLX2PSpHEQWCAZg
d6ciw3Hs/H6AwT7ILwBlrWlax/O3RcMApRroeOIfKp1tVgoujvPlfHXGGIgXnEjr
OfzLO6VBdaBYmKXQL3+zSweJtQXqby75JvLeS4+8SNwSyW4SOX+wgA63Q1imD6az
Max+FPo459kGf1bp5sgmtn1r4AsWuCFEBE93tYnAWA5RXXyZwdjN0UBbKmoENZwb
0eUuwymanPpJZ+LBRjlXS7fjpE3r9Dal9khxQnZ4L4mICYYyDqdTmCmXt/Dh+fTB
7SwCb+ptVmZqvZfg7Xmp4Kk9lIDaPXxjlUTfmQK26iiV/sR53RP3hgDMT9HXfxdQ
BuF5eRkOgT5oGTljqOpsZuxpSRTvVGpnTzRQ3ORq9kxv2pk9+z37A2RkHWbw95H6
JnmnrZrjUYjYXxnMn7TyFlEgrkWicQN1a3QOCq4hBOMgqfID8Q/doNTcvomchX1w
R+z+l737NWCTOvFN7DBL7GQcmzidTI7LwdEIVxK7+c0csSrycp0=
=nC9i
-----END PGP SIGNATURE-----

View file

@ -0,0 +1,139 @@
--- sys/compat/linux/linux_ioctl.c.orig
+++ sys/compat/linux/linux_ioctl.c
@@ -253,6 +253,7 @@
} else if ((args->cmd & 0xffff) == LINUX_HDIO_GET_GEO_BIG) {
struct linux_hd_big_geometry hdbg;
+ memset(&hdbg, 0, sizeof(hdbg));
hdbg.cylinders = fwcylinders;
hdbg.heads = fwheads;
hdbg.sectors = fwsectors;
@@ -2477,6 +2478,7 @@
printf("%s(): ioctl %d on %.*s\n", __func__,
args->cmd & 0xffff, LINUX_IFNAMSIZ, lifname);
#endif
+ memset(ifname, 0, sizeof(ifname));
ifp = ifname_linux_to_bsd(td, lifname, ifname);
if (ifp == NULL)
return (EINVAL);
--- sys/compat/linux/linux_ipc.c.orig
+++ sys/compat/linux/linux_ipc.c
@@ -548,6 +548,9 @@
register_t rval;
int cmd, error;
+ memset(&linux_seminfo, 0, sizeof(linux_seminfo));
+ memset(&linux_semid64, 0, sizeof(linux_semid64));
+
switch (args->cmd & ~LINUX_IPC_64) {
case LINUX_IPC_RMID:
cmd = IPC_RMID;
@@ -702,6 +705,8 @@
struct l_msqid64_ds linux_msqid64;
struct msqid_ds bsd_msqid;
+ memset(&linux_msqid64, 0, sizeof(linux_msqid64));
+
bsd_cmd = args->cmd & ~LINUX_IPC_64;
switch (bsd_cmd) {
case LINUX_IPC_INFO:
@@ -708,6 +713,7 @@
case LINUX_MSG_INFO: {
struct l_msginfo linux_msginfo;
+ memset(&linux_msginfo, 0, sizeof(linux_msginfo));
/*
* XXX MSG_INFO uses the same data structure but returns different
* dynamic counters in msgpool, msgmap, and msgtql fields.
@@ -833,6 +839,10 @@
struct shmid_ds bsd_shmid;
int error;
+ memset(&linux_shm_info, 0, sizeof(linux_shm_info));
+ memset(&linux_shmid64, 0, sizeof(linux_shmid64));
+ memset(&linux_shminfo64, 0, sizeof(linux_shminfo64));
+
switch (args->cmd & ~LINUX_IPC_64) {
case LINUX_IPC_INFO: {
--- sys/dev/ath/if_ath_btcoex.c.orig
+++ sys/dev/ath/if_ath_btcoex.c
@@ -457,7 +457,7 @@
* pointer for us to use below in reclaiming the buffer;
* may want to be more defensive.
*/
- outdata = malloc(outsize, M_TEMP, M_NOWAIT);
+ outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) {
error = ENOMEM;
goto bad;
@@ -466,6 +466,7 @@
switch (id) {
default:
error = EINVAL;
+ goto bad;
}
if (outsize < ad->ad_out_size)
ad->ad_out_size = outsize;
--- sys/dev/ath/if_ath_ioctl.c.orig
+++ sys/dev/ath/if_ath_ioctl.c
@@ -197,7 +197,7 @@
* pointer for us to use below in reclaiming the buffer;
* may want to be more defensive.
*/
- outdata = malloc(outsize, M_TEMP, M_NOWAIT);
+ outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) {
error = ENOMEM;
goto bad;
--- sys/dev/ath/if_ath_lna_div.c.orig
+++ sys/dev/ath/if_ath_lna_div.c
@@ -187,7 +187,7 @@
* pointer for us to use below in reclaiming the buffer;
* may want to be more defensive.
*/
- outdata = malloc(outsize, M_TEMP, M_NOWAIT);
+ outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) {
error = ENOMEM;
goto bad;
@@ -196,6 +196,7 @@
switch (id) {
default:
error = EINVAL;
+ goto bad;
}
if (outsize < ad->ad_out_size)
ad->ad_out_size = outsize;
--- sys/dev/ath/if_ath_spectral.c.orig
+++ sys/dev/ath/if_ath_spectral.c
@@ -212,7 +212,7 @@
* pointer for us to use below in reclaiming the buffer;
* may want to be more defensive.
*/
- outdata = malloc(outsize, M_TEMP, M_NOWAIT);
+ outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) {
error = ENOMEM;
goto bad;
@@ -275,6 +275,7 @@
break;
default:
error = EINVAL;
+ goto bad;
}
if (outsize < ad->ad_out_size)
ad->ad_out_size = outsize;
--- sys/netinet/tcp_usrreq.c.orig
+++ sys/netinet/tcp_usrreq.c
@@ -1495,7 +1495,9 @@
return (error);
} else if ((sopt->sopt_dir == SOPT_GET) &&
(sopt->sopt_name == TCP_FUNCTION_BLK)) {
- strcpy(fsn.function_set_name, tp->t_fb->tfb_tcp_block_name);
+ strncpy(fsn.function_set_name, tp->t_fb->tfb_tcp_block_name,
+ TCP_FUNCTION_NAME_LEN_MAX);
+ fsn.function_set_name[TCP_FUNCTION_NAME_LEN_MAX - 1] = '\0';
fsn.pcbcnt = tp->t_fb->tfb_refcnt;
INP_WUNLOCK(inp);
error = sooptcopyout(sopt, &fsn, sizeof fsn);

View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrxvQJfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cIwxQ//bgsLVPJ63nz0rDnWhF3qOLtJbE0ZTE2F5XRraNRaUVBx7ZpCyirSHnsU
CZvNVDtPxRGzxxgzPXj4gjtRuFK7VK5uKMG+tAL1i2A7S9ukbIOsD6y5R1VO3Vnj
uYPqGZgo437tnzgSCo/z7WAW98tDPzcbHJIO3gNNAG7Tu9+xfinLFP2GhFkYlsij
K/tplIX8OiT4X4Qcn4x3LNUIS9bXxMcX7ogkPqLEYlCOVT4h7IXXBJa6Z+IkSwSv
Y8xOmdDwp33t+JbEZt2NGMNG3evT1aYR/v0/GHPEjruPmK+fMSI5EmJOPPGn0zMn
7/vPiDacXDnyGIORFaerC0kZkQjaSwunzzO4npqBmj+jD7ALTtpyCY8fpHqPlERH
LkA+3xZDZqcgRVyVEWYq7exyyXNe2BkkENP8BZaZGUCPA9+uJ8dsDcw5D8DghMBG
KvbBcr+7zIiWRYM9rWwLS1t4y7GpC9DJxqvgAy2S7w8MGZsS6zGPsgt91cG71m+T
S+uEcuu1x3xowI6ODOTc3ISxD+V20yE464UdBYyN21zE67yuWRJXdMzIqQUbgSuU
W8w4z3sNFUlh1phVi9pCteX0Vgvt+YHEkd2NG0zoHp7//1a5vtSoSMgAN746eanP
MVdI7kaTjrjzJaaKPtb5zKdznLUH06mHspeI2qXrtb7XoRpSt2o=
=Q1kJ
-----END PGP SIGNATURE-----

View file

@ -0,0 +1,837 @@
--- contrib/tzdata/Makefile.orig
+++ contrib/tzdata/Makefile
@@ -21,7 +21,7 @@
# Change the line below for your time zone (after finding the zone you want in
# the time zone files, or adding it to a time zone file).
-# Alternately, if you discover you've got the wrong time zone, you can just
+# Alternatively, if you discover you've got the wrong time zone, you can just
# zic -l rightzone
# to correct things.
# Use the command
@@ -38,7 +38,7 @@
# template file are used to determine "spring forward" and "fall back" days and
# times; the environment variable itself specifies UT offsets of standard and
# daylight saving time.
-# Alternately, if you discover you've got the wrong time zone, you can just
+# Alternatively, if you discover you've got the wrong time zone, you can just
# zic -p rightzone
# to correct things.
# Use the command
@@ -236,14 +236,16 @@
$(GCC_INSTRUMENT) \
-Wall -Wextra \
-Walloc-size-larger-than=100000 -Warray-bounds=2 \
- -Wbad-function-cast -Wcast-align -Wdate-time \
+ -Wbad-function-cast -Wcast-align=strict -Wdate-time \
-Wdeclaration-after-statement -Wdouble-promotion \
-Wformat=2 -Wformat-overflow=2 -Wformat-signedness -Wformat-truncation \
-Winit-self -Wjump-misses-init -Wlogical-op \
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs \
-Wold-style-definition -Woverlength-strings -Wpointer-arith \
- -Wshadow -Wshift-overflow=2 -Wstrict-prototypes -Wstringop-overflow=5 \
+ -Wshadow -Wshift-overflow=2 -Wstrict-prototypes -Wstringop-overflow=4 \
+ -Wstringop-truncation -Wsuggest-attribute=cold \
-Wsuggest-attribute=const -Wsuggest-attribute=format \
+ -Wsuggest-attribute=malloc \
-Wsuggest-attribute=noreturn -Wsuggest-attribute=pure \
-Wtrampolines -Wundef -Wuninitialized -Wunused \
-Wvariadic-macros -Wvla -Wwrite-strings \
@@ -514,6 +516,7 @@
tzfile.5 tzfile.h tzselect.8 tzselect.ksh \
workman.sh yearistype.sh \
zdump.8 zdump.c zic.8 zic.c \
+ ziguard.awk zishrink.awk \
zone.tab zone1970.tab zoneinfo2tdf.pl
# And for the benefit of csh users on systems that assume the user
@@ -559,8 +562,8 @@
# These files can be tailored by setting BACKWARD, PACKRATDATA, etc.
vanguard.zi main.zi rearguard.zi: $(DSTDATA_ZI_DEPS)
- $(AWK) -v outfile='$@' -f ziguard.awk $(TDATA) $(PACKRATDATA) \
- >$@.out
+ $(AWK) -v DATAFORM=`expr $@ : '\(.*\).zi'` -f ziguard.awk \
+ $(TDATA) $(PACKRATDATA) >$@.out
mv $@.out $@
tzdata.zi: $(DATAFORM).zi version
version=`sed 1q version` && \
@@ -900,6 +903,13 @@
done
rm -fr time_t.dir
+TRADITIONAL_ASC = \
+ tzcode$(VERSION).tar.gz.asc \
+ tzdata$(VERSION).tar.gz.asc
+ALL_ASC = $(TRADITIONAL_ASC) \
+ tzdata$(VERSION)-rearguard.tar.gz.asc \
+ tzdb-$(VERSION).tar.lz.asc
+
tarballs traditional_tarballs signatures traditional_signatures: version
VERSION=`cat version` && \
$(MAKE) VERSION="$$VERSION" $@_version
@@ -907,12 +917,13 @@
# These *_version rules are intended for use if VERSION is set by some
# other means. Ordinarily these rules are used only by the above
# non-_version rules, which set VERSION on the 'make' command line.
-tarballs_version: traditional_tarballs_version tzdb-$(VERSION).tar.lz
+tarballs_version: traditional_tarballs_version \
+ tzdata$(VERSION)-rearguard.tar.gz \
+ tzdb-$(VERSION).tar.lz
traditional_tarballs_version: \
tzcode$(VERSION).tar.gz tzdata$(VERSION).tar.gz
-signatures_version: traditional_signatures_version tzdb-$(VERSION).tar.lz.asc
-traditional_signatures_version: \
- tzcode$(VERSION).tar.gz.asc tzdata$(VERSION).tar.gz.asc \
+signatures_version: $(ALL_ASC)
+traditional_signatures_version: $(TRADITIONAL_ASC)
tzcode$(VERSION).tar.gz: set-timestamps.out
LC_ALL=C && export LC_ALL && \
@@ -927,6 +938,26 @@
gzip $(GZIPFLAGS) >$@.out
mv $@.out $@
+tzdata$(VERSION)-rearguard.tar.gz: rearguard.zi set-timestamps.out
+ rm -fr tzdata$(VERSION)-rearguard.dir
+ mkdir tzdata$(VERSION)-rearguard.dir
+ ln $(COMMON) $(DATA) $(MISC) tzdata$(VERSION)-rearguard.dir
+ cd tzdata$(VERSION)-rearguard.dir && \
+ rm -f $(TDATA) $(PACKRATDATA) version
+ for f in $(TDATA) $(PACKRATDATA); do \
+ rearf=tzdata$(VERSION)-rearguard.dir/$$f; \
+ $(AWK) -v DATAFORM=rearguard -f ziguard.awk $$f >$$rearf && \
+ touch -cmr `ls -t ziguard.awk $$f` $$rearf || exit; \
+ done
+ sed '1s/$$/-rearguard/' \
+ <version >tzdata$(VERSION)-rearguard.dir/version
+ touch -cmr version tzdata$(VERSION)-rearguard.dir/version
+ LC_ALL=C && export LC_ALL && \
+ (cd tzdata$(VERSION)-rearguard.dir && \
+ tar $(TARFLAGS) -cf - $(COMMON) $(DATA) $(MISC) | \
+ gzip $(GZIPFLAGS)) >$@.out
+ mv $@.out $@
+
tzdb-$(VERSION).tar.lz: set-timestamps.out
rm -fr tzdb-$(VERSION)
mkdir tzdb-$(VERSION)
@@ -937,12 +968,10 @@
mv $@.out $@
tzcode$(VERSION).tar.gz.asc: tzcode$(VERSION).tar.gz
- gpg --armor --detach-sign $?
-
tzdata$(VERSION).tar.gz.asc: tzdata$(VERSION).tar.gz
- gpg --armor --detach-sign $?
-
+tzdata$(VERSION)-rearguard.tar.gz.asc: tzdata$(VERSION)-rearguard.tar.gz
tzdb-$(VERSION).tar.lz.asc: tzdb-$(VERSION).tar.lz
+$(ALL_ASC):
gpg --armor --detach-sign $?
typecheck:
--- contrib/tzdata/NEWS.orig
+++ contrib/tzdata/NEWS
@@ -1,5 +1,69 @@
News for the tz database
+Release 2018e - 2018-05-01 23:42:51 -0700
+
+ Briefly:
+
+ North Korea switches back to +09 on 2018-05-05.
+ The main format uses negative DST again, for Ireland etc.
+ 'make tarballs' now also builds a rearguard tarball.
+ New 's' and 'd' suffixes in SAVE columns of Rule and Zone lines.
+
+ Changes to past and future time stamps
+
+ North Korea switches back from +0830 to +09 on 2018-05-05.
+ (Thanks to Kang Seonghoon, Arthur David Olson, Seo Sanghyeon,
+ and Tim Parenti.)
+
+ Bring back the negative-DST changes of 2018a, except be more
+ compatible with data parsers that do not support negative DST.
+ Also, this now affects historical time stamps in Namibia and the
+ former Czechoslovakia, not just Ireland. The main format now uses
+ negative DST to model time stamps in Europe/Dublin (from 1971 on),
+ Europe/Prague (1946/7), and Africa/Windhoek (1994/2017). This
+ does not affect UT offsets, only time zone abbreviations and the
+ tm_isdst flag. Also, this does not affect rearguard or vanguard
+ formats; effectively the main format now uses vanguard instead of
+ rearguard format. Data parsers that do not support negative DST
+ can still use data from the rearguard tarball described below.
+
+ Changes to build procedure
+
+ The command 'make tarballs' now also builds the tarball
+ tzdataVERSION-rearguard.tar.gz, which is like tzdataVERSION.tar.gz
+ except that it uses rearguard format intended for trailing-edge
+ data parsers.
+
+ Changes to data format and to code
+
+ The SAVE column of Rule and Zone lines can now have an 's' or 'd'
+ suffix, which specifies whether the adjusted time is standard time
+ or daylight saving time. If no suffix is given, daylight saving
+ time is used if and only if the SAVE column is nonzero; this is
+ the longstanding behavior. Although this new feature is not used
+ in tzdata, it could be used to specify the legal time in Namibia
+ 1994-2017, as opposed to the popular time (see below).
+
+ Changes to past time stamps
+
+ From 1994 through 2017 Namibia observed DST in winter, not summer.
+ That is, it used negative DST, as Ireland still does. This change
+ does not affect UTC offsets; it affects only the tm_isdst flag and
+ the abbreviation used during summer, which is now CAT, not WAST.
+ Although (as noted by Michael Deckers) summer and winter time were
+ both simply called "standard time" in Namibian law, in common
+ practice winter time was considered to be DST (as noted by Stephen
+ Colebourne). The full effect of this change is only in vanguard
+ format; in rearguard and main format, the tm_isdst flag is still
+ zero in winter and nonzero in summer.
+
+ In 1946/7 Czechoslovakia also observed negative DST in winter.
+ The full effect of this change is only in vanguard format; in
+ rearguard and main formats, it is modeled as plain GMT without
+ daylight saving. Also, the dates of some 1944/5 DST transitions
+ in Czechoslovakia have been changed.
+
+
Release 2018d - 2018-03-22 07:05:46 -0700
Briefly:
@@ -39,7 +103,7 @@
Enderbury and Kiritimati skipped New Year's Eve 1994, not
New Year's Day 1995. (Thanks to Kerry Shetline.)
- Fix the 1912-01-01 transition for Portugual and its colonies.
+ Fix the 1912-01-01 transition for Portugal and its colonies.
This transition was at 00:00 according to the new UT offset, not
according to the old one. Also assume that Cape Verde switched on
the same date as the rest, not in 1907. This affects
--- contrib/tzdata/africa.orig
+++ contrib/tzdata/africa
@@ -6,7 +6,7 @@
# tz@iana.org for general use in the future). For more, please see
# the file CONTRIBUTING in the tz distribution.
-# From Paul Eggert (2017-02-20):
+# From Paul Eggert (2017-04-09):
#
# Unless otherwise specified, the source for data through 1990 is:
# Thomas G. Shanks and Rique Pottenger, The International Atlas (6th edition),
@@ -52,7 +52,7 @@
# cannot now come up with solid citations.
#
# I invented the following abbreviations; corrections are welcome!
-# +02 WAST West Africa Summer Time
+# +02 WAST West Africa Summer Time (no longer used)
# +03 CAST Central Africa Summer Time (no longer used)
# +03 SAST South Africa Summer Time (no longer used)
# +03 EAT East Africa Time
@@ -967,6 +967,10 @@
# commence at OOhOO on Monday 21 March 1994 and shall end at 02h00 on
# Sunday 4 September 1994.
+# From Michael Deckers (2017-04-06):
+# ... both summer and winter time are called "standard"
+# (which differs from the use in Ireland) ...
+
# From Petronella Sibeene (2007-03-30):
# http://allafrica.com/stories/200703300178.html
# While the entire country changes its time, Katima Mulilo and other
@@ -992,10 +996,26 @@
# the same time they would normally start DST, the first Sunday in September:
# https://www.timeanddate.com/news/time/namibia-new-time-zone.html
+# From Paul Eggert (2017-04-09):
+# Before the change, summer and winter time were both standard time legally.
+# However in common parlance, winter time was considered to be DST. See, e.g.:
+# http://www.nbc.na/news/namibias-winter-time-could-be-scrapped.2706
+# https://zone.my.na/news/times-are-changing-in-namibia
+# https://www.newera.com.na/2017/02/23/namibias-winter-time-might-be-repealed/
+# Use plain "WAT" and "CAT" for the time zone abbreviations, to be compatible
+# with Namibia's neighbors.
+
# RULE NAME FROM TO TYPE IN ON AT SAVE LETTER/S
-Rule Namibia 1994 only - Mar 21 0:00 0 -
-Rule Namibia 1994 2016 - Sep Sun>=1 2:00 1:00 S
-Rule Namibia 1995 2017 - Apr Sun>=1 2:00 0 -
+# Vanguard section, for zic and other parsers that support negative DST.
+Rule Namibia 1994 only - Mar 21 0:00 -1:00 WAT
+Rule Namibia 1994 2017 - Sep Sun>=1 2:00 0 CAT
+Rule Namibia 1995 2017 - Apr Sun>=1 2:00 -1:00 WAT
+# Rearguard section, for parsers that do not support negative DST.
+#Rule Namibia 1994 only - Mar 21 0:00 0 WAT
+#Rule Namibia 1994 2017 - Sep Sun>=1 2:00 1:00 CAT
+#Rule Namibia 1995 2017 - Apr Sun>=1 2:00 0 WAT
+# End of rearguard section.
+
# Zone NAME GMTOFF RULES FORMAT [UNTIL]
Zone Africa/Windhoek 1:08:24 - LMT 1892 Feb 8
1:30 - +0130 1903 Mar
@@ -1002,9 +1022,16 @@
2:00 - SAST 1942 Sep 20 2:00
2:00 1:00 SAST 1943 Mar 21 2:00
2:00 - SAST 1990 Mar 21 # independence
- 2:00 - CAT 1994 Mar 21 0:00
- 1:00 Namibia WA%sT 2017 Sep 3 2:00
- 2:00 - CAT
+# Vanguard section, for zic and other parsers that support negative DST.
+ 2:00 Namibia %s
+# Rearguard section, for parsers that do not support negative DST.
+# 2:00 - CAT 1994 Mar 21 0:00
+# From Paul Eggert (2017-04-07):
+# The official date of the 2017 rule change was 2017-10-24. See:
+# http://www.lac.org.na/laws/annoSTAT/Namibian%20Time%20Act%209%20of%202017.pdf
+# 1:00 Namibia %s 2017 Oct 24
+# 2:00 - CAT
+# End of rearguard section.
# Niger
# See Africa/Lagos.
--- contrib/tzdata/asia.orig
+++ contrib/tzdata/asia
@@ -1983,6 +1983,19 @@
# There is no common English-language abbreviation for this time zone.
# Use KST, as that's what we already use for 1954-1961 in ROK.
+# From Kang Seonghoon (2018-04-29):
+# North Korea will revert its time zone from UTC+8:30 (PYT; Pyongyang
+# Time) back to UTC+9 (KST; Korea Standard Time).
+#
+# From Seo Sanghyeon (2018-04-30):
+# Rodong Sinmun 2018-04-30 announced Pyongyang Time transition plan.
+# https://www.nknews.org/kcna/wp-content/uploads/sites/5/2018/04/rodong-2018-04-30.pdf
+# ... the transition date is 2018-05-05 ... Citation should be Decree
+# No. 2232 of April 30, 2018, of the Presidium of the Supreme People's
+# Assembly, as published in Rodong Sinmun.
+# From Tim Parenti (2018-04-29):
+# It appears to be the front page story at the top in the right-most column.
+
# Zone NAME GMTOFF RULES FORMAT [UNTIL]
Zone Asia/Seoul 8:27:52 - LMT 1908 Apr 1
8:30 - KST 1912 Jan 1
@@ -1994,7 +2007,8 @@
8:30 - KST 1912 Jan 1
9:00 - JST 1945 Aug 24
9:00 - KST 2015 Aug 15 00:00
- 8:30 - KST
+ 8:30 - KST 2018 May 5
+ 9:00 - KST
###############################################################################
@@ -2658,7 +2672,7 @@
# From Sharef Mustafa (2018-03-16):
# Palestine summer time will start on Mar 24th 2018 by advancing the
# clock by 60 minutes as per Palestinian cabinet decision published on
-# the offical website, though the decree did not specify the exact
+# the official website, though the decree did not specify the exact
# time of the time shift.
# http://www.palestinecabinet.gov.ps/Website/AR/NDecrees/ViewFile.ashx?ID=e7a42ab7-ee23-435a-b9c8-a4f7e81f3817
#
--- contrib/tzdata/australasia.orig
+++ contrib/tzdata/australasia
@@ -1085,6 +1085,15 @@
# (1999-09-27) writes that Giles Meteorological Station uses
# South Australian time even though it's located in Western Australia.
+# From Paul Eggert (2018-04-01):
+# The Guardian Express of Perth, Australia reported today that the
+# government decided to advance the clocks permanently on January 1,
+# 2019, from UT +08 to UT +09. The article noted that an exemption
+# would be made for people aged 61 and over, who "can apply in writing
+# to have the extra hour of sunshine removed from their area." See:
+# Daylight saving coming to WA in 2019. Guardian Express. 2018-04-01.
+# https://www.communitynews.com.au/guardian-express/news/exclusive-daylight-savings-coming-wa-summer-2018/
+
# Queensland
# From Paul Eggert (2018-02-26):
--- contrib/tzdata/europe.orig
+++ contrib/tzdata/europe
@@ -528,13 +528,13 @@
# summer and negative daylight saving time in winter. It is for when
# negative SAVE values are used.
# Rule NAME FROM TO TYPE IN ON AT SAVE LETTER/S
-#Rule Eire 1971 only - Oct 31 2:00u -1:00 GMT
-#Rule Eire 1972 1980 - Mar Sun>=16 2:00u 0 IST
-#Rule Eire 1972 1980 - Oct Sun>=23 2:00u -1:00 GMT
-#Rule Eire 1981 max - Mar lastSun 1:00u 0 IST
-#Rule Eire 1981 1989 - Oct Sun>=23 1:00u -1:00 GMT
-#Rule Eire 1990 1995 - Oct Sun>=22 1:00u -1:00 GMT
-#Rule Eire 1996 max - Oct lastSun 1:00u -1:00 GMT
+Rule Eire 1971 only - Oct 31 2:00u -1:00 -
+Rule Eire 1972 1980 - Mar Sun>=16 2:00u 0 -
+Rule Eire 1972 1980 - Oct Sun>=23 2:00u -1:00 -
+Rule Eire 1981 max - Mar lastSun 1:00u 0 -
+Rule Eire 1981 1989 - Oct Sun>=23 1:00u -1:00 -
+Rule Eire 1990 1995 - Oct Sun>=22 1:00u -1:00 -
+Rule Eire 1996 max - Oct lastSun 1:00u -1:00 -
# Zone NAME GMTOFF RULES FORMAT [UNTIL]
Zone Europe/Dublin -0:25:00 - LMT 1880 Aug 2
@@ -548,11 +548,11 @@
0:00 - GMT 1948 Apr 18 2:00s
0:00 GB-Eire GMT/IST 1968 Oct 27
# The next line is for when negative SAVE values are used.
-# 1:00 Eire IST/GMT
+ 1:00 Eire IST/GMT
# These three lines are for when SAVE values are always nonnegative.
- 1:00 - IST 1971 Oct 31 2:00u
- 0:00 GB-Eire GMT/IST 1996
- 0:00 EU GMT/IST
+# 1:00 - IST 1971 Oct 31 2:00u
+# 0:00 GB-Eire GMT/IST 1996
+# 0:00 EU GMT/IST
###############################################################################
@@ -970,18 +970,30 @@
# Please see the 'asia' file for Asia/Nicosia.
# Czech Republic / Czechia
+#
+# From Paul Eggert (2018-04-15):
+# The source for Czech data is: Kdy začíná a končí letní čas. 2018-04-15.
+# https://kalendar.beda.cz/kdy-zacina-a-konci-letni-cas
+# We know of no English-language name for historical Czech winter time;
+# abbreviate it as "GMT", as it happened to be GMT.
+#
# Rule NAME FROM TO TYPE IN ON AT SAVE LETTER/S
-Rule Czech 1945 only - Apr 8 2:00s 1:00 S
-Rule Czech 1945 only - Nov 18 2:00s 0 -
+Rule Czech 1945 only - Apr Mon>=1 2:00s 1:00 S
+Rule Czech 1945 only - Oct 1 2:00s 0 -
Rule Czech 1946 only - May 6 2:00s 1:00 S
Rule Czech 1946 1949 - Oct Sun>=1 2:00s 0 -
-Rule Czech 1947 only - Apr 20 2:00s 1:00 S
-Rule Czech 1948 only - Apr 18 2:00s 1:00 S
+Rule Czech 1947 1948 - Apr Sun>=15 2:00s 1:00 S
Rule Czech 1949 only - Apr 9 2:00s 1:00 S
# Zone NAME GMTOFF RULES FORMAT [UNTIL]
Zone Europe/Prague 0:57:44 - LMT 1850
0:57:44 - PMT 1891 Oct # Prague Mean Time
- 1:00 C-Eur CE%sT 1944 Sep 17 2:00s
+ 1:00 C-Eur CE%sT 1945 May 9
+ 1:00 Czech CE%sT 1946 Dec 1 3:00
+# Vanguard section, for zic and other parsers that support negative DST.
+ 1:00 -1:00 GMT 1947 Feb 23 2:00
+# Rearguard section, for parsers that do not support negative DST.
+# 0:00 - GMT 1947 Feb 23 2:00
+# End of rearguard section.
1:00 Czech CE%sT 1979
1:00 EU CE%sT
# Use Europe/Prague also for Slovakia.
@@ -2016,7 +2028,7 @@
Rule Neth 1945 only - Apr 2 2:00s 1:00 S
Rule Neth 1945 only - Sep 16 2:00s 0 -
#
-# Amsterdam Mean Time was +00:19:32.13 exactly, but the .13 is omitted
+# Amsterdam Mean Time was +00:19:32.13, but the .13 is omitted
# below because the current format requires GMTOFF to be an integer.
# Zone NAME GMTOFF RULES FORMAT [UNTIL]
Zone Europe/Amsterdam 0:19:32 - LMT 1835
--- contrib/tzdata/theory.html.orig
+++ contrib/tzdata/theory.html
@@ -32,7 +32,7 @@
It organizes <a href="tz-link.html">time zone and daylight saving time
data</a> by partitioning the world into <a
href="https://en.wikipedia.org/wiki/List_of_tz_database_time_zones">regions</a>
-whose clocks all agree about timestamps that occur after the of the <a
+whose clocks all agree about timestamps that occur after the <a
href="https://en.wikipedia.org/wiki/Unix_time">POSIX Epoch</a>
(1970-01-01 00:00:00 <a
href="https://en.wikipedia.org/wiki/Coordinated_Universal_Time"><abbr
@@ -53,7 +53,7 @@
applications requiring accurate handling of all past times everywhere,
as it would take far too much effort and guesswork to record all
details of pre-1970 civil timekeeping.
-Athough some information outside the scope of the database is
+Although some information outside the scope of the database is
collected in a file <code>backzone</code> that is distributed along
with the database proper, this file is less reliable and does not
necessarily follow database guidelines.
@@ -68,7 +68,7 @@
href="https://en.wikipedia.org/wiki/Unix">UNIX</a>-like systems.
As of this writing, the current edition of POSIX is: <a
href="http://pubs.opengroup.org/onlinepubs/9699919799/"> The Open
-Group Base Specifications Issue 7</a>, IEEE Std 1003.1-2008, 2016
+Group Base Specifications Issue 7</a>, IEEE Std 1003.1-2017, 2018
Edition.
Because the database's scope encompasses real-world changes to civil
timekeeping, its model for describing time is more complex than the
@@ -79,7 +79,7 @@
can change at times.
Whether and when a <code><abbr>tz</abbr></code> region changes its
clock, and even the region's notional base offset from UTC, are variable.
-It doesn't even really make sense to talk about a region's
+It does not always make sense to talk about a region's
"base offset", since it is not necessarily a single number.
</p>
@@ -92,8 +92,8 @@
corresponds to a set of time zone rules.
Inexperienced users are not expected to select these names unaided.
Distributors should provide documentation and/or a simple selection
-interface that explains the names; for one example, see the 'tzselect'
-program in the <code><abbr>tz</abbr></code> code.
+interface that explains the names; for one example, see the
+<code>tzselect</code> program in the <code><abbr>tz</abbr></code> code.
The <a href="http://cldr.unicode.org/">Unicode Common Locale Data
Repository</a> contains data that may be useful for other selection
interfaces.
@@ -137,6 +137,9 @@
North and South America share the same area, '<code>America</code>'.
Typical names are '<code>Africa/Cairo</code>',
'<code>America/New_York</code>', and '<code>Pacific/Honolulu</code>'.
+Some names are further qualified to help avoid confusion; for example,
+'<code>America/Indiana/Petersburg</code>' distinguishes Petersburg,
+Indiana from other Petersburgs in America.
</p>
<p>
@@ -159,7 +162,8 @@
<code>TZ</code> strings</a>.
A file name component must not exceed 14 characters or start with
'<code>-</code>'.
- E.g., prefer '<code>Brunei</code>' to '<code>Bandar_Seri_Begawan</code>'.
+ E.g., prefer <code>Asia/Brunei</code> to
+ <code>Asia/Bandar_Seri_Begawan</code>.
Exceptions: see the discussion of legacy names below.
</li>
<li>
@@ -177,8 +181,8 @@
name <var>AB</var> (ignoring case), then <var>B</var> must not
start with '<code>/</code>', as a regular file cannot have the
same name as a directory in POSIX.
- For example, '<code>America/New_York</code>' precludes
- '<code>America/New_York/Bronx</code>'.
+ For example, <code>America/New_York</code> precludes
+ <code>America/New_York/Bronx</code>.
</li>
<li>
Uninhabited regions like the North Pole and Bouvet Island
@@ -193,7 +197,7 @@
</li>
<li>
If all the clocks in a region have agreed since 1970,
- don't bother to include more than one location
+ do not bother to include more than one location
even if subregions' clocks disagreed before 1970.
Otherwise these tables would become annoyingly large.
</li>
@@ -200,8 +204,9 @@
<li>
If a name is ambiguous, use a less ambiguous alternative;
e.g., many cities are named San José and Georgetown, so
- prefer '<code>Costa_Rica</code>' to '<code>San_Jose</code>' and
- '<code>Guyana</code>' to '<code>Georgetown</code>'.
+ prefer <code>America/Costa_Rica</code> to
+ <code>America/San_Jose</code> and <code>America/Guyana</code>
+ to <code>America/Georgetown</code>.
</li>
<li>
Keep locations compact.
@@ -208,35 +213,40 @@
Use cities or small islands, not countries or regions, so that any
future changes do not split individual locations into different
<code><abbr>tz</abbr></code> regions.
- E.g., prefer '<code>Paris</code>' to '<code>France</code>', since
+ E.g., prefer <code>Europe/Paris</code> to <code>Europe/France</code>,
+ since
<a href="https://en.wikipedia.org/wiki/Time_in_France#History">France
has had multiple time zones</a>.
</li>
<li>
- Use mainstream English spelling, e.g., prefer '<code>Rome</code>'
- to '<code>Roma</code>', and prefer '<code>Athens</code>' to the
- Greek '<code>Αθήνα</code>' or the Romanized '<code>Athína</code>'.
+ Use mainstream English spelling, e.g., prefer
+ <code>Europe/Rome</code> to <code>Europe/Roma</code>, and
+ prefer <code>Europe/Athens</code> to the Greek
+ <code>Europe/Αθήνα</code> or the Romanized
+ <code>Europe/Athína</code>.
The POSIX file name restrictions encourage this guideline.
</li>
<li>
Use the most populous among locations in a region,
- e.g., prefer '<code>Shanghai</code>' to
- '<code>Beijing</code>'.
+ e.g., prefer <code>Asia/Shanghai</code> to
+ <code>Asia/Beijing</code>.
Among locations with similar populations, pick the best-known
- location, e.g., prefer '<code>Rome</code>' to
- '<code>Milan</code>'.
+ location, e.g., prefer <code>Europe/Rome</code> to
+ <code>Europe/Milan</code>.
</li>
<li>
- Use the singular form, e.g., prefer '<code>Canary</code>' to
- '<code>Canaries</code>'.
+ Use the singular form, e.g., prefer <code>Atlantic/Canary</code> to
+ <code>Atlantic/Canaries</code>.
</li>
<li>
Omit common suffixes like '<code>_Islands</code>' and
'<code>_City</code>', unless that would lead to ambiguity.
- E.g., prefer '<code>Cayman</code>' to
- '<code>Cayman_Islands</code>' and '<code>Guatemala</code>' to
- '<code>Guatemala_City</code>', but prefer
- '<code>Mexico_City</code>' to '<code>Mexico</code>'
+ E.g., prefer <code>America/Cayman</code> to
+ <code>America/Cayman_Islands</code> and
+ <code>America/Guatemala</code> to
+ <code>America/Guatemala_City</code>, but prefer
+ <code>America/Mexico_City</code> to
+ <code>America/Mexico</code>
because <a href="https://en.wikipedia.org/wiki/Time_in_Mexico">the
country of Mexico has several time zones</a>.
</li>
@@ -245,13 +255,14 @@
</li>
<li>
Omit '<code>.</code>' from abbreviations in names.
- E.g., prefer '<code>St_Helena</code>' to '<code>St._Helena</code>'.
+ E.g., prefer <code>Atlantic/St_Helena</code> to
+ <code>Atlantic/St._Helena</code>.
</li>
<li>
Do not change established names if they only marginally violate
the above guidelines.
- For example, don't change the existing name '<code>Rome</code>' to
- '<code>Milan</code>' merely because Milan's population has grown
+ For example, do not change the existing name <code>Europe/Rome</code> to
+ <code>Europe/Milan</code> merely because Milan's population has grown
to be somewhat greater than Rome's.
</li>
<li>
@@ -318,8 +329,10 @@
Use three to six characters that are ASCII alphanumerics or
'<code>+</code>' or '<code>-</code>'.
Previous editions of this database also used characters like
- '<code> </code>' and '<code>?</code>', but these characters have a
- special meaning to the shell and cause commands like
+ space and '<code>?</code>', but these characters have a
+ special meaning to the
+ <a href="https://en.wikipedia.org/wiki/Unix_shell">UNIX shell</a>
+ and cause commands like
'<code><a href="http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#set">set</a>
`<a href="http://pubs.opengroup.org/onlinepubs/9699919799/utilities/date.html">date</a>`</code>'
to have unexpected effects.
@@ -688,7 +701,7 @@
subsecond accuracy is needed.
</li>
<li>
- Civil time was not based on atomic time before 1972, and we don't
+ Civil time was not based on atomic time before 1972, and we do not
know the history of
<a href="https://en.wikipedia.org/wiki/Earth's_rotation">earth's
rotation</a> accurately enough to map <a
@@ -720,7 +733,7 @@
Ideally it would contain information about when data entries are
incomplete or dicey.
Partial temporal knowledge is a field of active research, though,
- and it's not clear how to apply it here.
+ and it is not clear how to apply it here.
</li>
</ul>
@@ -764,7 +777,7 @@
Unfortunately, the POSIX
<code>TZ</code> string takes a form that is hard to describe and
is error-prone in practice.
- Also, POSIX <code>TZ</code> strings can't deal with daylight
+ Also, POSIX <code>TZ</code> strings cannot deal with daylight
saving time rules not based on the Gregorian calendar (as in
Iran), or with situations where more than two time zone
abbreviations or <abbr>UT</abbr> offsets are used in an area.
@@ -874,7 +887,7 @@
need access to multiple time zone rulesets.
</li>
<li>
- In POSIX, there's no tamper-proof way for a process to learn the
+ In POSIX, there is no tamper-proof way for a process to learn the
system's best idea of local wall clock.
(This is important for applications that an administrator wants
used only at certain times &ndash; without regard to whether the
@@ -973,14 +986,16 @@
by subsequent calls to <code>localtime</code>.
Source code for portable applications that "must" run on local wall
clock time should call <code>tzsetwall</code>;
- if such code is moved to "old" systems that don't
- provide <code>tzsetwall</code>, you won't be able to generate an
+ if such code is moved to "old" systems that do not
+ provide <code>tzsetwall</code>, you will not be able to generate an
executable program.
(These functions also arrange for local wall clock time to
be used if <code>tzset</code> is called &ndash; directly or
- indirectly &ndash; and there's no <code>TZ</code> environment
+ indirectly &ndash; and there is no <code>TZ</code> environment
variable; portable applications should not, however, rely on this
- behavior since it's not the way SVR2 systems behave.)
+ behavior since it is not the way <a
+ href="https://en.wikipedia.org/wiki/UNIX_System_V#SVR2"><abbr>SVR2</abbr></a>
+ systems behave.)
</li>
<li>
Negative <code>time_t</code> values are supported, on systems
@@ -1040,7 +1055,7 @@
<li>
The <a href="https://en.wikipedia.org/wiki/Version_7_Unix">7th Edition
UNIX</a> <code>timezone</code> function is not present in this
- package; it's impossible to reliably map <code>timezone</code>'s
+ package; it is impossible to reliably map <code>timezone</code>'s
arguments (a "minutes west of <abbr>GMT</abbr>" value and a
"daylight saving time in effect" flag) to a time zone
abbreviation, and we refuse to guess.
@@ -1052,7 +1067,9 @@
zone abbreviation to use.
</li>
<li>
- The <abbr>4.2BSD</abbr> <code>gettimeofday</code> function is not
+ The <a
+ href="https://en.wikipedia.org/wiki/History_of_the_Berkeley_Software_Distribution#4.2BSD"><abbr>4.2BSD</abbr></a>
+ <code>gettimeofday</code> function is not
used in this package.
This formerly let users obtain the current <abbr>UTC</abbr> offset
and <abbr>DST</abbr> flag, but this functionality was removed in
@@ -1061,7 +1078,7 @@
<li>
In <abbr>SVR2</abbr>, time conversion fails for near-minimum or
near-maximum <code>time_t</code> values when doing conversions
- for places that don't use <abbr>UT</abbr>.
+ for places that do not use <abbr>UT</abbr>.
This package takes care to do these conversions correctly.
A comment in the source code tells how to get compatibly wrong
results.
@@ -1155,10 +1172,10 @@
Calendrical issues are a bit out of scope for a time zone database,
but they indicate the sort of problems that we would run into if we
extended the time zone database further into the past.
-An excellent resource in this area is Nachum Dershowitz and Edward M.
-Reingold, <cite><a
-href="https://www.cs.tau.ac.il/~nachum/calendar-book/third-edition/">Calendrical
-Calculations: Third Edition</a></cite>, Cambridge University Press (2008).
+An excellent resource in this area is Edward M. Reingold
+and Nachum Dershowitz, <cite><a
+href="https://www.cambridge.org/fr/academic/subjects/computer-science/computing-general-interest/calendrical-calculations-ultimate-edition-4th-edition">Calendrical
+Calculations: The Ultimate Edition</a></cite>, Cambridge University Press (2018).
Other information and sources are given in the file '<code>calendars</code>'
in the <code><abbr>tz</abbr></code> distribution.
They sometimes disagree.
@@ -1170,11 +1187,11 @@
<p>
Some people's work schedules
use <a href="https://en.wikipedia.org/wiki/Timekeeping on Mars">Mars time</a>.
-Jet Propulsion Laboratory (JPL) coordinators have kept Mars time on
-and off at least since 1997 for the
+Jet Propulsion Laboratory (JPL) coordinators kept Mars time on
+and off during the
<a href="https://en.wikipedia.org/wiki/Mars_Pathfinder#End_of_mission">Mars
Pathfinder</a> mission.
-Some of their family members have also adapted to Mars time.
+Some of their family members also adapted to Mars time.
Dozens of special Mars watches were built for JPL workers who kept
Mars time during the Mars Exploration Rovers mission (2004).
These timepieces look like normal Seikos and Citizens but use Mars
@@ -1262,7 +1279,7 @@
Jia-Rui Chong,
"<a href="http://articles.latimes.com/2004/jan/14/science/sci-marstime14">Workdays
Fit for a Martian</a>", <cite>Los Angeles Times</cite>
- (2004-01-14), pp A1, A20-A21.
+ (2004-01-14), pp A1, A20&ndash;A21.
</li>
<li>
Tom Chmielewski,
--- contrib/tzdata/version.orig
+++ contrib/tzdata/version
@@ -1 +1 @@
-2018d
+2018e
--- contrib/tzdata/ziguard.awk.orig
+++ contrib/tzdata/ziguard.awk
@@ -13,20 +13,31 @@
# rearguard format.
BEGIN {
- dst_type["vanguard.zi"] = 1
- dst_type["main.zi"] = 1
- dst_type["rearguard.zi"] = 1
+ dataform_type["vanguard"] = 1
+ dataform_type["main"] = 1
+ dataform_type["rearguard"] = 1
- # The command line should set OUTFILE to the name of the output file.
- if (!dst_type[outfile]) exit 1
- vanguard = outfile == "vanguard.zi"
+ # The command line should set DATAFORM.
+ if (!dataform_type[DATAFORM]) exit 1
+ vanguard = DATAFORM == "vanguard"
}
/^Zone/ { zone = $2 }
-outfile != "main.zi" {
+DATAFORM != "main" {
in_comment = /^#/
+ uncomment = comment_out = 0
+ # If the line should differ due to Czechoslovakia using negative SAVE values,
+ # uncomment the desired version and comment out the undesired one.
+ if (zone == "Europe/Prague" && /1947 Feb 23/) {
+ if (($(in_comment + 2) != "-") == vanguard) {
+ uncomment = in_comment
+ } else {
+ comment_out = !in_comment
+ }
+ }
+
# If this line should differ due to Ireland using negative SAVE values,
# uncomment the desired version and comment out the undesired one.
Rule_Eire = /^#?Rule[\t ]+Eire[\t ]/
@@ -37,11 +48,38 @@
if ((Rule_Eire \
|| (Zone_Dublin_post_1968 && $(in_comment + 3) == "IST/GMT")) \
== vanguard) {
- sub(/^#/, "")
- } else if (/^[^#]/) {
- sub(/^/, "#")
+ uncomment = in_comment
+ } else {
+ comment_out = !in_comment
}
}
+
+ # If this line should differ due to Namibia using Rule SAVE suffixes,
+ # uncomment the desired version and comment out the undesired one.
+ Rule_Namibia = /^#?Rule[\t ]+Namibia[\t ]/
+ Zone_using_Namibia_rule \
+ = (zone == "Africa/Windhoek" \
+ && ($(in_comment + 2) == "Namibia" \
+ || (1994 <= $(in_comment + 4) && $(in_comment + 4) <= 2017) \
+ || in_comment + 3 == NF))
+ if (Rule_Namibia || Zone_using_Namibia_rule) {
+ if ((Rule_Namibia \
+ ? ($(in_comment + 9) ~ /^-/ \
+ || ($(in_comment + 9) == 0 && $(in_comment + 10) == "CAT")) \
+ : $(in_comment + 1) == "2:00" && $(in_comment + 2) == "Namibia") \
+ == vanguard) {
+ uncomment = in_comment
+ } else {
+ comment_out = !in_comment
+ }
+ }
+
+ if (uncomment) {
+ sub(/^#/, "")
+ }
+ if (comment_out) {
+ sub(/^/, "#")
+ }
}
# If a Link line is followed by a Zone line for the same data, comment

View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrxvQlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cIEgg//XFE1ecg9Ig1L76g4/e73j2ebLpT6bF1XIlyPnZJJZ2sMbH9jpyrdFb8D
mkbmrY2N/NIEx6m5Mx/Go6SQ41tQosdlEZVezu4C1j4SKlcCIctKsRhdi8sdYXFm
tuWjTjBeWQ9IvoPjMDYt7WmkrX5hR5vTiXFvFlB9w3Ao7TSIwuwLtlBFySEG1eKR
+rJs7AqeSLR5tdppJA1q3N2WOGmSBAZu0kz23xJu3EKTcxIhV1LQ9rbi0HhxY00d
yyvf/yWV7z0slPyuug5V5a+EaVm3FGflWes/Uv0ZBkNtCgy2KlcgeJjWpQoi3ziL
5rqshQBGEkYxa+DKJiJz2hP4B+MnIgYQtUSmenOLMH4T7RMpNtBNdFbVOOJojokQ
dnHWrrlSdjyNuLcyARqRgah2+T+p9pIyMKCcsE5AKI3d8q20flsUSThZa2cuBWZe
p4XrdBPo+9bPr6v4rduJkE3ZnudHmDLTjhG9aCQ2CYyoqu2CRFeCxbW40rhHg7T1
jre7xjDQ0rDnuOxzF7CfXFKChN6cJRtKox6wj9lcvg4v/fXh93Z85oJytzYXPQIg
0n64N0fGerdswVYGwqHxz8T1lURESc11mtZ1rhHWDv12S/Cbszfvh0tqoaewOTpP
Jzdmb+MVzKaCu0jNjmAm3K7QmZ8FtXTXCiq+hEhWlnGusNvFMrQ=
=t6qO
-----END PGP SIGNATURE-----

View file

@ -0,0 +1,295 @@
--- sys/amd64/amd64/exception.S.orig
+++ sys/amd64/amd64/exception.S
@@ -108,8 +108,6 @@
movq $0,TF_ADDR(%rsp) ; \
movq $0,TF_ERR(%rsp) ; \
jmp alltraps_noen
-IDTVEC(dbg)
- TRAP_NOEN(T_TRCTRAP)
IDTVEC(bpt)
TRAP_NOEN(T_BPTFLT)
#ifdef KDTRACE_HOOKS
@@ -436,6 +434,101 @@
sysret
/*
+ * DB# handler is very similar to NM#, because 'mov/pop %ss' delay
+ * generation of exception until the next instruction is executed,
+ * which might be a kernel entry. So we must execute the handler
+ * on IST stack and be ready for non-kernel GSBASE.
+ */
+IDTVEC(dbg)
+ subq $TF_RIP,%rsp
+ movl $(T_TRCTRAP),TF_TRAPNO(%rsp)
+ movq $0,TF_ADDR(%rsp)
+ movq $0,TF_ERR(%rsp)
+ movq %rdi,TF_RDI(%rsp)
+ movq %rsi,TF_RSI(%rsp)
+ movq %rdx,TF_RDX(%rsp)
+ movq %rcx,TF_RCX(%rsp)
+ movq %r8,TF_R8(%rsp)
+ movq %r9,TF_R9(%rsp)
+ movq %rax,TF_RAX(%rsp)
+ movq %rbx,TF_RBX(%rsp)
+ movq %rbp,TF_RBP(%rsp)
+ movq %r10,TF_R10(%rsp)
+ movq %r11,TF_R11(%rsp)
+ movq %r12,TF_R12(%rsp)
+ movq %r13,TF_R13(%rsp)
+ movq %r14,TF_R14(%rsp)
+ movq %r15,TF_R15(%rsp)
+ movw %fs,TF_FS(%rsp)
+ movw %gs,TF_GS(%rsp)
+ movw %es,TF_ES(%rsp)
+ movw %ds,TF_DS(%rsp)
+ movl $TF_HASSEGS,TF_FLAGS(%rsp)
+ cld
+ testb $SEL_RPL_MASK,TF_CS(%rsp)
+ jnz dbg_fromuserspace
+ /*
+ * We've interrupted the kernel. Preserve GS.base in %r12.
+ */
+ movl $MSR_GSBASE,%ecx
+ rdmsr
+ movq %rax,%r12
+ shlq $32,%rdx
+ orq %rdx,%r12
+ /* Retrieve and load the canonical value for GS.base. */
+ movq TF_SIZE(%rsp),%rdx
+ movl %edx,%eax
+ shrq $32,%rdx
+ wrmsr
+ FAKE_MCOUNT(TF_RIP(%rsp))
+ movq %rsp,%rdi
+ call trap
+ MEXITCOUNT
+ /*
+ * Put back the preserved MSR_GSBASE value.
+ */
+ movl $MSR_GSBASE,%ecx
+ movq %r12,%rdx
+ movl %edx,%eax
+ shrq $32,%rdx
+ wrmsr
+ movq TF_RDI(%rsp),%rdi
+ movq TF_RSI(%rsp),%rsi
+ movq TF_RDX(%rsp),%rdx
+ movq TF_RCX(%rsp),%rcx
+ movq TF_R8(%rsp),%r8
+ movq TF_R9(%rsp),%r9
+ movq TF_RAX(%rsp),%rax
+ movq TF_RBX(%rsp),%rbx
+ movq TF_RBP(%rsp),%rbp
+ movq TF_R10(%rsp),%r10
+ movq TF_R11(%rsp),%r11
+ movq TF_R12(%rsp),%r12
+ movq TF_R13(%rsp),%r13
+ movq TF_R14(%rsp),%r14
+ movq TF_R15(%rsp),%r15
+ addq $TF_RIP,%rsp
+ jmp doreti_iret
+dbg_fromuserspace:
+ /*
+ * Switch to kernel GSBASE and kernel page table, and copy frame
+ * from the IST stack to the normal kernel stack, since trap()
+ * re-enables interrupts, and since we might trap on DB# while
+ * in trap().
+ */
+ swapgs
+ movq PCPU(RSP0),%rax
+ movl $TF_SIZE,%ecx
+ subq %rcx,%rax
+ movq %rax,%rdi
+ movq %rsp,%rsi
+ rep;movsb
+ movq %rax,%rsp
+ movq PCPU(CURPCB),%rdi
+ orl $PCB_FULL_IRET,PCB_FLAGS(%rdi)
+ jmp calltrap
+
+/*
* NMI handling is special.
*
* First, NMIs do not respect the state of the processor's RFLAGS.IF
--- sys/amd64/amd64/machdep.c.orig
+++ sys/amd64/amd64/machdep.c
@@ -1023,6 +1023,7 @@
static char dblfault_stack[PAGE_SIZE] __aligned(16);
static char nmi0_stack[PAGE_SIZE] __aligned(16);
+static char dbg0_stack[PAGE_SIZE] __aligned(16);
CTASSERT(sizeof(struct nmi_pcpu) == 16);
struct amd64tss common_tss[MAXCPU];
@@ -1908,7 +1909,7 @@
for (x = 0; x < NIDT; x++)
setidt(x, &IDTVEC(rsvd), SDT_SYSIGT, SEL_KPL, 0);
setidt(IDT_DE, &IDTVEC(div), SDT_SYSIGT, SEL_KPL, 0);
- setidt(IDT_DB, &IDTVEC(dbg), SDT_SYSIGT, SEL_KPL, 0);
+ setidt(IDT_DB, &IDTVEC(dbg), SDT_SYSIGT, SEL_KPL, 4);
setidt(IDT_NMI, &IDTVEC(nmi), SDT_SYSIGT, SEL_KPL, 2);
setidt(IDT_BP, &IDTVEC(bpt), SDT_SYSIGT, SEL_UPL, 0);
setidt(IDT_OF, &IDTVEC(ofl), SDT_SYSIGT, SEL_KPL, 0);
@@ -1966,6 +1967,13 @@
np->np_pcpu = (register_t) pc;
common_tss[0].tss_ist2 = (long) np;
+ /*
+ * DB# stack, runs on ist4.
+ */
+ np = ((struct nmi_pcpu *) &dbg0_stack[sizeof(dbg0_stack)]) - 1;
+ np->np_pcpu = (register_t) pc;
+ common_tss[0].tss_ist4 = (long) np;
+
/* Set the IO permission bitmap (empty due to tss seg limit) */
common_tss[0].tss_iobase = sizeof(struct amd64tss) +
IOPAGES * PAGE_SIZE;
--- sys/amd64/amd64/mp_machdep.c.orig
+++ sys/amd64/amd64/mp_machdep.c
@@ -98,6 +98,7 @@
/* Temporary variables for init_secondary() */
char *doublefault_stack;
char *nmi_stack;
+char *dbg_stack;
void *dpcpu;
struct pcb stoppcbs[MAXCPU];
@@ -647,6 +648,10 @@
np = ((struct nmi_pcpu *) &nmi_stack[PAGE_SIZE]) - 1;
common_tss[cpu].tss_ist2 = (long) np;
+ /* The DB# stack runs on IST4. */
+ np = ((struct nmi_pcpu *) &dbg_stack[PAGE_SIZE]) - 1;
+ common_tss[cpu].tss_ist4 = (long) np;
+
/* Prepare private GDT */
gdt_segs[GPROC0_SEL].ssd_base = (long) &common_tss[cpu];
for (x = 0; x < NGDT; x++) {
@@ -682,6 +687,10 @@
/* Save the per-cpu pointer for use by the NMI handler. */
np->np_pcpu = (register_t) pc;
+ /* Save the per-cpu pointer for use by the DB# handler. */
+ np = ((struct nmi_pcpu *) &dbg_stack[PAGE_SIZE]) - 1;
+ np->np_pcpu = (register_t) pc;
+
wrmsr(MSR_FSBASE, 0); /* User value */
wrmsr(MSR_GSBASE, (u_int64_t)pc);
wrmsr(MSR_KGSBASE, (u_int64_t)pc); /* XXX User value while we're in the kernel */
@@ -970,6 +979,8 @@
PAGE_SIZE, M_WAITOK | M_ZERO);
nmi_stack = (char *)kmem_malloc(kernel_arena, PAGE_SIZE,
M_WAITOK | M_ZERO);
+ dbg_stack = (char *)kmem_malloc(kernel_arena, PAGE_SIZE,
+ M_WAITOK | M_ZERO);
dpcpu = (void *)kmem_malloc(kernel_arena, DPCPU_SIZE,
M_WAITOK | M_ZERO);
--- sys/amd64/amd64/trap.c.orig
+++ sys/amd64/amd64/trap.c
@@ -45,6 +45,7 @@
*/
#include "opt_clock.h"
+#include "opt_compat.h"
#include "opt_cpu.h"
#include "opt_hwpmc_hooks.h"
#include "opt_isa.h"
@@ -98,6 +99,9 @@
#include <sys/dtrace_bsd.h>
#endif
+extern inthand_t IDTVEC(bpt), IDTVEC(dbg), IDTVEC(fast_syscall),
+ IDTVEC(fast_syscall32), IDTVEC(int0x80_syscall);
+
extern void trap(struct trapframe *frame);
extern void syscall(struct trapframe *frame);
void dblfault_handler(struct trapframe *frame);
@@ -549,7 +553,40 @@
load_dr6(rdr6() & 0xfffffff0);
goto out;
}
+
/*
+ * Malicious user code can configure a debug
+ * register watchpoint to trap on data access
+ * to the top of stack and then execute 'pop
+ * %ss; int 3'. Due to exception deferral for
+ * 'pop %ss', the CPU will not interrupt 'int
+ * 3' to raise the DB# exception for the debug
+ * register but will postpone the DB# until
+ * execution of the first instruction of the
+ * BP# handler (in kernel mode). Normally the
+ * previous check would ignore DB# exceptions
+ * for watchpoints on user addresses raised in
+ * kernel mode. However, some CPU errata
+ * include cases where DB# exceptions do not
+ * properly set bits in %dr6, e.g. Haswell
+ * HSD23 and Skylake-X SKZ24.
+ *
+ * A deferred DB# can also be raised on the
+ * first instructions of system call entry
+ * points or single-step traps via similar use
+ * of 'pop %ss' or 'mov xxx, %ss'.
+ */
+ if (frame->tf_rip == (uintptr_t)IDTVEC(fast_syscall) ||
+#ifdef COMPAT_FREEBSD32
+ frame->tf_rip ==
+ (uintptr_t)IDTVEC(int0x80_syscall) ||
+#endif
+ frame->tf_rip == (uintptr_t)IDTVEC(bpt) ||
+ frame->tf_rip == (uintptr_t)IDTVEC(dbg) ||
+ /* Needed for AMD. */
+ frame->tf_rip == (uintptr_t)IDTVEC(fast_syscall32))
+ return;
+ /*
* FALLTHROUGH (TRCTRAP kernel mode, kernel address)
*/
case T_BPTFLT:
--- sys/i386/i386/trap.c.orig
+++ sys/i386/i386/trap.c
@@ -116,6 +116,8 @@
extern inthand_t IDTVEC(lcall_syscall);
+extern inthand_t IDTVEC(bpt), IDTVEC(dbg), IDTVEC(int0x80_syscall);
+
#define MAX_TRAP_MSG 32
static char *trap_msg[] = {
"", /* 0 unused */
@@ -683,7 +685,35 @@
load_dr6(rdr6() & 0xfffffff0);
goto out;
}
+
/*
+ * Malicious user code can configure a debug
+ * register watchpoint to trap on data access
+ * to the top of stack and then execute 'pop
+ * %ss; int 3'. Due to exception deferral for
+ * 'pop %ss', the CPU will not interrupt 'int
+ * 3' to raise the DB# exception for the debug
+ * register but will postpone the DB# until
+ * execution of the first instruction of the
+ * BP# handler (in kernel mode). Normally the
+ * previous check would ignore DB# exceptions
+ * for watchpoints on user addresses raised in
+ * kernel mode. However, some CPU errata
+ * include cases where DB# exceptions do not
+ * properly set bits in %dr6, e.g. Haswell
+ * HSD23 and Skylake-X SKZ24.
+ *
+ * A deferred DB# can also be raised on the
+ * first instructions of system call entry
+ * points or single-step traps via similar use
+ * of 'pop %ss' or 'mov xxx, %ss'.
+ */
+ if (frame->tf_eip ==
+ (uintptr_t)IDTVEC(int0x80_syscall) ||
+ frame->tf_eip == (uintptr_t)IDTVEC(bpt) ||
+ frame->tf_eip == (uintptr_t)IDTVEC(dbg))
+ return;
+ /*
* FALLTHROUGH (TRCTRAP kernel mode, kernel address)
*/
case T_BPTFLT:

View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrxw1dfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cJZkw//eSdjhBGww2Q/GXezM9AkyNHgqYL3FuWpP2TPght7YbfoZYHrpzn3oPbC
JfqtNrh0rBVKxBag3+aZ7VZ2ktGqjiNEVUtQGfYSWBhtaRz7o6H1jkpYWKNqjYWA
/7cNi4+5FqSa1SmC+aPnM6jR+BI8k7lsW9CrCA3AgB/wfswzbd5X2SjUgeDWACnO
1bEC4hEBd4I57Gk0S++3iHhM1LKANVoLDZsCU7sF+6aWxQNxjnswLvG0UjIdAwsQ
T9g20sShkZBJrAD+IQEEqkxrW/0RVoO6RuS3bQXw8U4ZeIhOV0RzV7EsEtcGJIzg
HZTiSm6jfxvjtvA52yG4TgnCknGI5quKlWTCj4CI+YnXxCu7NruDg1bOowyel1Of
2FjX7c1oEDenVTDBMD9T/o2UpOc/L8xXZtoqLR4iHXSCS2yPo4ikJnJHNVXseEZg
6HlRH+0p0OJ4ciGwN0xt4W5n+0J/8p2xlPPOGhjfDLFg+NiXbFyIWNCZlz6PO8Kc
+sMQ1Oq14bIqXlrwAq5EaGJWxXILC2VC+qU9XnRNTskGhLVc3I/9qcaOE2QLjH9Z
ufa6cRHw3KOn2Yd+b06/OzlRhVUn5dCSIXWiTt4RnPF9IFWK6WESjPkC89p4OcxN
wFP5VGRbjyANbeD/IWksFlN+I6Ss0+eROhIBG6vgt+Lra1g62js=
=4kXk
-----END PGP SIGNATURE-----

View file

@ -0,0 +1,351 @@
--- sys/amd64/amd64/exception.S.orig
+++ sys/amd64/amd64/exception.S
@@ -116,7 +116,6 @@
jmp alltraps_noen
.endm
- TRAP_NOEN dbg, T_TRCTRAP
TRAP_NOEN bpt, T_BPTFLT
#ifdef KDTRACE_HOOKS
TRAP_NOEN dtrace_ret, T_DTRACE_RET
@@ -509,6 +508,121 @@
sysret
/*
+ * DB# handler is very similar to NM#, because 'mov/pop %ss' delay
+ * generation of exception until the next instruction is executed,
+ * which might be a kernel entry. So we must execute the handler
+ * on IST stack and be ready for non-kernel GSBASE.
+ */
+IDTVEC(dbg)
+ subq $TF_RIP,%rsp
+ movl $(T_TRCTRAP),TF_TRAPNO(%rsp)
+ movq $0,TF_ADDR(%rsp)
+ movq $0,TF_ERR(%rsp)
+ movq %rdi,TF_RDI(%rsp)
+ movq %rsi,TF_RSI(%rsp)
+ movq %rdx,TF_RDX(%rsp)
+ movq %rcx,TF_RCX(%rsp)
+ movq %r8,TF_R8(%rsp)
+ movq %r9,TF_R9(%rsp)
+ movq %rax,TF_RAX(%rsp)
+ movq %rbx,TF_RBX(%rsp)
+ movq %rbp,TF_RBP(%rsp)
+ movq %r10,TF_R10(%rsp)
+ movq %r11,TF_R11(%rsp)
+ movq %r12,TF_R12(%rsp)
+ movq %r13,TF_R13(%rsp)
+ movq %r14,TF_R14(%rsp)
+ movq %r15,TF_R15(%rsp)
+ SAVE_SEGS
+ movl $TF_HASSEGS,TF_FLAGS(%rsp)
+ cld
+ testb $SEL_RPL_MASK,TF_CS(%rsp)
+ jnz dbg_fromuserspace
+ /*
+ * We've interrupted the kernel. Preserve GS.base in %r12,
+ * %cr3 in %r13, and possibly lower half of MSR_IA32_SPEC_CTL in %r14d.
+ */
+ movl $MSR_GSBASE,%ecx
+ rdmsr
+ movq %rax,%r12
+ shlq $32,%rdx
+ orq %rdx,%r12
+ /* Retrieve and load the canonical value for GS.base. */
+ movq TF_SIZE(%rsp),%rdx
+ movl %edx,%eax
+ shrq $32,%rdx
+ wrmsr
+ movq %cr3,%r13
+ movq PCPU(KCR3),%rax
+ cmpq $~0,%rax
+ je 1f
+ movq %rax,%cr3
+1: testl $CPUID_STDEXT3_IBPB,cpu_stdext_feature3(%rip)
+ je 2f
+ movl $MSR_IA32_SPEC_CTRL,%ecx
+ rdmsr
+ movl %eax,%r14d
+ call handle_ibrs_entry
+2: FAKE_MCOUNT(TF_RIP(%rsp))
+ movq %rsp,%rdi
+ call trap
+ MEXITCOUNT
+ testl $CPUID_STDEXT3_IBPB,cpu_stdext_feature3(%rip)
+ je 3f
+ movl %r14d,%eax
+ xorl %edx,%edx
+ movl $MSR_IA32_SPEC_CTRL,%ecx
+ wrmsr
+ /*
+ * Put back the preserved MSR_GSBASE value.
+ */
+3: movl $MSR_GSBASE,%ecx
+ movq %r12,%rdx
+ movl %edx,%eax
+ shrq $32,%rdx
+ wrmsr
+ movq %r13,%cr3
+ RESTORE_REGS
+ addq $TF_RIP,%rsp
+ jmp doreti_iret
+dbg_fromuserspace:
+ /*
+ * Switch to kernel GSBASE and kernel page table, and copy frame
+ * from the IST stack to the normal kernel stack, since trap()
+ * re-enables interrupts, and since we might trap on DB# while
+ * in trap().
+ */
+ swapgs
+ movq PCPU(KCR3),%rax
+ cmpq $~0,%rax
+ je 1f
+ movq %rax,%cr3
+1: movq PCPU(RSP0),%rax
+ movl $TF_SIZE,%ecx
+ subq %rcx,%rax
+ movq %rax,%rdi
+ movq %rsp,%rsi
+ rep;movsb
+ movq %rax,%rsp
+ call handle_ibrs_entry
+ movq PCPU(CURPCB),%rdi
+ orl $PCB_FULL_IRET,PCB_FLAGS(%rdi)
+ testb $CPUID_STDEXT_FSGSBASE,cpu_stdext_feature(%rip)
+ jz 3f
+ cmpw $KUF32SEL,TF_FS(%rsp)
+ jne 2f
+ rdfsbase %rax
+ movq %rax,PCB_FSBASE(%rdi)
+2: cmpw $KUG32SEL,TF_GS(%rsp)
+ jne 3f
+ movl $MSR_KGSBASE,%ecx
+ rdmsr
+ shlq $32,%rdx
+ orq %rdx,%rax
+ movq %rax,PCB_GSBASE(%rdi)
+3: jmp calltrap
+
+/*
* NMI handling is special.
*
* First, NMIs do not respect the state of the processor's RFLAGS.IF
--- sys/amd64/amd64/machdep.c.orig
+++ sys/amd64/amd64/machdep.c
@@ -675,6 +675,7 @@
static char dblfault_stack[PAGE_SIZE] __aligned(16);
static char mce0_stack[PAGE_SIZE] __aligned(16);
static char nmi0_stack[PAGE_SIZE] __aligned(16);
+static char dbg0_stack[PAGE_SIZE] __aligned(16);
CTASSERT(sizeof(struct nmi_pcpu) == 16);
struct amd64tss common_tss[MAXCPU];
@@ -827,7 +828,7 @@
IDTVEC(tss), IDTVEC(missing), IDTVEC(stk), IDTVEC(prot),
IDTVEC(page), IDTVEC(mchk), IDTVEC(rsvd), IDTVEC(fpu), IDTVEC(align),
IDTVEC(xmm), IDTVEC(dblfault),
- IDTVEC(div_pti), IDTVEC(dbg_pti), IDTVEC(bpt_pti),
+ IDTVEC(div_pti), IDTVEC(bpt_pti),
IDTVEC(ofl_pti), IDTVEC(bnd_pti), IDTVEC(ill_pti), IDTVEC(dna_pti),
IDTVEC(fpusegm_pti), IDTVEC(tss_pti), IDTVEC(missing_pti),
IDTVEC(stk_pti), IDTVEC(prot_pti), IDTVEC(page_pti),
@@ -1637,8 +1638,7 @@
SEL_KPL, 0);
setidt(IDT_DE, pti ? &IDTVEC(div_pti) : &IDTVEC(div), SDT_SYSIGT,
SEL_KPL, 0);
- setidt(IDT_DB, pti ? &IDTVEC(dbg_pti) : &IDTVEC(dbg), SDT_SYSIGT,
- SEL_KPL, 0);
+ setidt(IDT_DB, &IDTVEC(dbg), SDT_SYSIGT, SEL_KPL, 4);
setidt(IDT_NMI, &IDTVEC(nmi), SDT_SYSIGT, SEL_KPL, 2);
setidt(IDT_BP, pti ? &IDTVEC(bpt_pti) : &IDTVEC(bpt), SDT_SYSIGT,
SEL_UPL, 0);
@@ -1720,6 +1720,13 @@
np = ((struct nmi_pcpu *) &mce0_stack[sizeof(mce0_stack)]) - 1;
np->np_pcpu = (register_t) pc;
common_tss[0].tss_ist3 = (long) np;
+
+ /*
+ * DB# stack, runs on ist4.
+ */
+ np = ((struct nmi_pcpu *) &dbg0_stack[sizeof(dbg0_stack)]) - 1;
+ np->np_pcpu = (register_t) pc;
+ common_tss[0].tss_ist4 = (long) np;
/* Set the IO permission bitmap (empty due to tss seg limit) */
common_tss[0].tss_iobase = sizeof(struct amd64tss) + IOPERM_BITMAP_SIZE;
--- sys/amd64/amd64/mp_machdep.c.orig
+++ sys/amd64/amd64/mp_machdep.c
@@ -87,6 +87,7 @@
char *doublefault_stack;
char *mce_stack;
char *nmi_stack;
+char *dbg_stack;
/*
* Local data and functions.
@@ -225,6 +226,10 @@
np = ((struct nmi_pcpu *) &mce_stack[PAGE_SIZE]) - 1;
common_tss[cpu].tss_ist3 = (long) np;
+ /* The DB# stack runs on IST4. */
+ np = ((struct nmi_pcpu *) &dbg_stack[PAGE_SIZE]) - 1;
+ common_tss[cpu].tss_ist4 = (long) np;
+
/* Prepare private GDT */
gdt_segs[GPROC0_SEL].ssd_base = (long) &common_tss[cpu];
for (x = 0; x < NGDT; x++) {
@@ -270,6 +275,10 @@
np = ((struct nmi_pcpu *) &mce_stack[PAGE_SIZE]) - 1;
np->np_pcpu = (register_t) pc;
+ /* Save the per-cpu pointer for use by the DB# handler. */
+ np = ((struct nmi_pcpu *) &dbg_stack[PAGE_SIZE]) - 1;
+ np->np_pcpu = (register_t) pc;
+
wrmsr(MSR_FSBASE, 0); /* User value */
wrmsr(MSR_GSBASE, (u_int64_t)pc);
wrmsr(MSR_KGSBASE, (u_int64_t)pc); /* XXX User value while we're in the kernel */
@@ -368,6 +377,8 @@
M_WAITOK | M_ZERO);
nmi_stack = (char *)kmem_malloc(kernel_arena, PAGE_SIZE,
M_WAITOK | M_ZERO);
+ dbg_stack = (char *)kmem_malloc(kernel_arena, PAGE_SIZE,
+ M_WAITOK | M_ZERO);
dpcpu = (void *)kmem_malloc(kernel_arena, DPCPU_SIZE,
M_WAITOK | M_ZERO);
--- sys/amd64/amd64/pmap.c.orig
+++ sys/amd64/amd64/pmap.c
@@ -7565,6 +7565,9 @@
/* MC# stack IST 3 */
va = common_tss[i].tss_ist3 + sizeof(struct nmi_pcpu);
pmap_pti_add_kva_locked(va - PAGE_SIZE, va, false);
+ /* DB# stack IST 4 */
+ va = common_tss[i].tss_ist4 + sizeof(struct nmi_pcpu);
+ pmap_pti_add_kva_locked(va - PAGE_SIZE, va, false);
}
pmap_pti_add_kva_locked((vm_offset_t)kernphys + KERNBASE,
(vm_offset_t)etext, true);
--- sys/amd64/amd64/trap.c.orig
+++ sys/amd64/amd64/trap.c
@@ -45,6 +45,7 @@
*/
#include "opt_clock.h"
+#include "opt_compat.h"
#include "opt_cpu.h"
#include "opt_hwpmc_hooks.h"
#include "opt_isa.h"
@@ -99,6 +100,11 @@
#include <sys/dtrace_bsd.h>
#endif
+extern inthand_t IDTVEC(bpt), IDTVEC(bpt_pti), IDTVEC(dbg),
+ IDTVEC(fast_syscall), IDTVEC(fast_syscall_pti), IDTVEC(fast_syscall32),
+ IDTVEC(int0x80_syscall_pti), IDTVEC(int0x80_syscall);
+
+
extern void __noinline trap(struct trapframe *frame);
extern void trap_check(struct trapframe *frame);
extern void syscall(struct trapframe *frame);
@@ -536,7 +542,53 @@
load_dr6(rdr6() & ~0xf);
goto out;
}
+
/*
+ * Malicious user code can configure a debug
+ * register watchpoint to trap on data access
+ * to the top of stack and then execute 'pop
+ * %ss; int 3'. Due to exception deferral for
+ * 'pop %ss', the CPU will not interrupt 'int
+ * 3' to raise the DB# exception for the debug
+ * register but will postpone the DB# until
+ * execution of the first instruction of the
+ * BP# handler (in kernel mode). Normally the
+ * previous check would ignore DB# exceptions
+ * for watchpoints on user addresses raised in
+ * kernel mode. However, some CPU errata
+ * include cases where DB# exceptions do not
+ * properly set bits in %dr6, e.g. Haswell
+ * HSD23 and Skylake-X SKZ24.
+ *
+ * A deferred DB# can also be raised on the
+ * first instructions of system call entry
+ * points or single-step traps via similar use
+ * of 'pop %ss' or 'mov xxx, %ss'.
+ */
+ if (pti) {
+ if (frame->tf_rip ==
+ (uintptr_t)IDTVEC(fast_syscall_pti) ||
+#ifdef COMPAT_FREEBSD32
+ frame->tf_rip ==
+ (uintptr_t)IDTVEC(int0x80_syscall_pti) ||
+#endif
+ frame->tf_rip == (uintptr_t)IDTVEC(bpt_pti))
+ return;
+ } else {
+ if (frame->tf_rip ==
+ (uintptr_t)IDTVEC(fast_syscall) ||
+#ifdef COMPAT_FREEBSD32
+ frame->tf_rip ==
+ (uintptr_t)IDTVEC(int0x80_syscall) ||
+#endif
+ frame->tf_rip == (uintptr_t)IDTVEC(bpt))
+ return;
+ }
+ if (frame->tf_rip == (uintptr_t)IDTVEC(dbg) ||
+ /* Needed for AMD. */
+ frame->tf_rip == (uintptr_t)IDTVEC(fast_syscall32))
+ return;
+ /*
* FALLTHROUGH (TRCTRAP kernel mode, kernel address)
*/
case T_BPTFLT:
--- sys/i386/i386/trap.c.orig
+++ sys/i386/i386/trap.c
@@ -116,6 +116,8 @@
extern inthand_t IDTVEC(lcall_syscall);
+extern inthand_t IDTVEC(bpt), IDTVEC(dbg), IDTVEC(int0x80_syscall);
+
#define MAX_TRAP_MSG 32
static char *trap_msg[] = {
"", /* 0 unused */
@@ -668,7 +670,35 @@
load_dr6(rdr6() & ~0xf);
goto out;
}
+
/*
+ * Malicious user code can configure a debug
+ * register watchpoint to trap on data access
+ * to the top of stack and then execute 'pop
+ * %ss; int 3'. Due to exception deferral for
+ * 'pop %ss', the CPU will not interrupt 'int
+ * 3' to raise the DB# exception for the debug
+ * register but will postpone the DB# until
+ * execution of the first instruction of the
+ * BP# handler (in kernel mode). Normally the
+ * previous check would ignore DB# exceptions
+ * for watchpoints on user addresses raised in
+ * kernel mode. However, some CPU errata
+ * include cases where DB# exceptions do not
+ * properly set bits in %dr6, e.g. Haswell
+ * HSD23 and Skylake-X SKZ24.
+ *
+ * A deferred DB# can also be raised on the
+ * first instructions of system call entry
+ * points or single-step traps via similar use
+ * of 'pop %ss' or 'mov xxx, %ss'.
+ */
+ if (frame->tf_eip ==
+ (uintptr_t)IDTVEC(int0x80_syscall) ||
+ frame->tf_eip == (uintptr_t)IDTVEC(bpt) ||
+ frame->tf_eip == (uintptr_t)IDTVEC(dbg))
+ return;
+ /*
* FALLTHROUGH (TRCTRAP kernel mode, kernel address)
*/
case T_BPTFLT:

View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrxw2RfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cJlSBAAkuyBE359un4LyuLYWmE+xqM0v766eFkagBW8MSu8zEgNNXAM4fvNdsYq
teZ1UWK45Nx3fslOu3FLBam3T4YcKcMO3pgFirg/hLsSsMCQT7vo4l7U5WECgKg1
Yp2gJOq+Dm8lkUqvSLYG4gvOCaPRTOY9aQFY8TW+WWjrl4L9O5orUcARGAuESBPc
NhdMxfRcWHbIjpzluu+aps2qTDUdf3swJGe50qHH78Iz6pW7VEYEDOI+O6UAw2BD
E+LAyo1HTW8pH0FvzZAFWxYy+bKXAQNdklF0bs40amFkZupYlGqa4cJljXz5ih9R
E2CKdiFeaoXYnfkPDQnIEt78LOYzS3dLNsoKub7VyR2Q2uaW89MobU5BIocJ/mXD
KcTwiUKVyQWtSpxEB3K/aTfCpse1lOiv7vmVKNhiZk8ZDvQx4UcCwLQLZUvOPFNT
axJCyT5wSB3rTF4IRfuF3YsBGC71ymK9hDnsn+qlhJADkdrfYlPnF74je7yT3W11
OdnK7vNflQU/fT7PUXJUIGEXAbsFYEbz2gCPgiRyb/weuTLfZbOrvrDn4cmFHSFx
oFHqJtwkct5jPBBy4G0ydbeBJW+RUr2sOGXsMqyUBcEzcAzrTy1eA6/KAfH1jxIM
2q/R8tLUyklAuC8Si5Vukg21WWLzOjk+2E260TtjtAkJY4xwIiA=
=zp4W
-----END PGP SIGNATURE-----

View file

@ -7,6 +7,19 @@
<year>
<name>2018</name>
<month>
<name>5</name>
<day>
<name>8</name>
<advisory>
<name>FreeBSD-SA-18:06.debugreg</name>
</advisory>
</day>
</month>
<month>
<name>4</name>

View file

@ -7,6 +7,23 @@
<year>
<name>2018</name>
<month>
<name>5</name>
<day>
<name>8</name>
<notice>
<name>FreeBSD-EN-18:06.tzdata</name>
</notice>
<notice>
<name>FreeBSD-EN-18:05.mem</name>
</notice>
</day>
</month>
<month>
<name>4</name>