os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Add EN-19:16, EN-19:17, and SA-19:22 to SA-19:24.

Browse source 
Approved by:	so
This commit is contained in:
Gordon Tetlow 2019-08-20 18:45:04 +00:00
parent 1b1329f892
commit c973531199
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=53312
17 changed files with 1439 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

239
share/security/patches/EN-19:16/bhyve.patch Normal file
View file

@ -0,0 +1,239 @@
--- sys/amd64/vmm/vmm_instruction_emul.c.orig
+++ sys/amd64/vmm/vmm_instruction_emul.c
@@ -77,6 +77,8 @@
VIE_OP_TYPE_STOS,
VIE_OP_TYPE_BITTEST,
VIE_OP_TYPE_TWOB_GRP15,
+ VIE_OP_TYPE_ADD,
+ VIE_OP_TYPE_TEST,
VIE_OP_TYPE_LAST
};
@@ -112,6 +114,10 @@
};
static const struct vie_op one_byte_opcodes[256] = {
+ [0x03] = {
+ .op_byte = 0x03,
+ .op_type = VIE_OP_TYPE_ADD,
+ },
[0x0F] = {
.op_byte = 0x0F,
.op_type = VIE_OP_TYPE_TWO_BYTE
@@ -216,6 +222,12 @@
.op_byte = 0x8F,
.op_type = VIE_OP_TYPE_POP,
},
+ [0xF7] = {
+ /* XXX Group 3 extended opcode - not just TEST */
+ .op_byte = 0xF7,
+ .op_type = VIE_OP_TYPE_TEST,
+ .op_flags = VIE_OP_F_IMM,
+ },
[0xFF] = {
/* XXX Group 5 extended opcode - not just PUSH */
.op_byte = 0xFF,
@@ -410,6 +422,76 @@
return (getcc64(x, y));
}
+/*
+ * Macro creation of functions getaddflags{8,16,32,64}
+ */
+#define GETADDFLAGS(sz) \
+static u_long \
+getaddflags##sz(uint##sz##_t x, uint##sz##_t y) \
+{ \
+ u_long rflags; \
+ \
+ __asm __volatile("add %2,%1; pushfq; popq %0" : \
+ "=r" (rflags), "+r" (x) : "m" (y)); \
+ return (rflags); \
+} struct __hack
+
+GETADDFLAGS(8);
+GETADDFLAGS(16);
+GETADDFLAGS(32);
+GETADDFLAGS(64);
+
+static u_long
+getaddflags(int opsize, uint64_t x, uint64_t y)
+{
+ KASSERT(opsize == 1 || opsize == 2 || opsize == 4 || opsize == 8,
+ ("getaddflags: invalid operand size %d", opsize));
+
+ if (opsize == 1)
+ return (getaddflags8(x, y));
+ else if (opsize == 2)
+ return (getaddflags16(x, y));
+ else if (opsize == 4)
+ return (getaddflags32(x, y));
+ else
+ return (getaddflags64(x, y));
+}
+
+/*
+ * Return the status flags that would result from doing (x & y).
+ */
+#define GETANDFLAGS(sz) \
+static u_long \
+getandflags##sz(uint##sz##_t x, uint##sz##_t y) \
+{ \
+ u_long rflags; \
+ \
+ __asm __volatile("and %2,%1; pushfq; popq %0" : \
+ "=r" (rflags), "+r" (x) : "m" (y)); \
+ return (rflags); \
+} struct __hack
+
+GETANDFLAGS(8);
+GETANDFLAGS(16);
+GETANDFLAGS(32);
+GETANDFLAGS(64);
+
+static u_long
+getandflags(int opsize, uint64_t x, uint64_t y)
+{
+ KASSERT(opsize == 1 || opsize == 2 || opsize == 4 || opsize == 8,
+ ("getandflags: invalid operand size %d", opsize));
+
+ if (opsize == 1)
+ return (getandflags8(x, y));
+ else if (opsize == 2)
+ return (getandflags16(x, y));
+ else if (opsize == 4)
+ return (getandflags32(x, y));
+ else
+ return (getandflags64(x, y));
+}
+
static int
emulate_mov(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
mem_region_read_t memread, mem_region_write_t memwrite, void *arg)
@@ -1179,6 +1261,111 @@
}
static int
+emulate_test(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+ mem_region_read_t memread, mem_region_write_t memwrite, void *arg)
+{
+ int error, size;
+ uint64_t op1, rflags, rflags2;
+
+ size = vie->opsize;
+ error = EINVAL;
+
+ switch (vie->op.op_byte) {
+ case 0xF7:
+ /*
+ * F7 /0 test r/m16, imm16
+ * F7 /0 test r/m32, imm32
+ * REX.W + F7 /0 test r/m64, imm32 sign-extended to 64
+ *
+ * Test mem (ModRM:r/m) with immediate and set status
+ * flags according to the results. The comparison is
+ * performed by anding the immediate from the first
+ * operand and then setting the status flags.
+ */
+ if ((vie->reg & 7) != 0)
+ return (EINVAL);
+
+ error = memread(vm, vcpuid, gpa, &op1, size, arg);
+ if (error)
+ return (error);
+
+ rflags2 = getandflags(size, op1, vie->immediate);
+ break;
+ default:
+ return (EINVAL);
+ }
+ error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, &rflags);
+ if (error)
+ return (error);
+
+ /*
+ * OF and CF are cleared; the SF, ZF and PF flags are set according
+ * to the result; AF is undefined.
+ */
+ rflags &= ~RFLAGS_STATUS_BITS;
+ rflags |= rflags2 & (PSL_PF | PSL_Z | PSL_N);
+
+ error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RFLAGS, rflags, 8);
+ return (error);
+}
+
+static int
+emulate_add(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
+ mem_region_read_t memread, mem_region_write_t memwrite, void *arg)
+{
+ int error, size;
+ uint64_t nval, rflags, rflags2, val1, val2;
+ enum vm_reg_name reg;
+
+ size = vie->opsize;
+ error = EINVAL;
+
+ switch (vie->op.op_byte) {
+ case 0x03:
+ /*
+ * ADD r/m to r and store the result in r
+ *
+ * 03/r ADD r16, r/m16
+ * 03/r ADD r32, r/m32
+ * REX.W + 03/r ADD r64, r/m64
+ */
+
+ /* get the first operand */
+ reg = gpr_map[vie->reg];
+ error = vie_read_register(vm, vcpuid, reg, &val1);
+ if (error)
+ break;
+
+ /* get the second operand */
+ error = memread(vm, vcpuid, gpa, &val2, size, arg);
+ if (error)
+ break;
+
+ /* perform the operation and write the result */
+ nval = val1 + val2;
+ error = vie_update_register(vm, vcpuid, reg, nval, size);
+ break;
+ default:
+ break;
+ }
+
+ if (!error) {
+ rflags2 = getaddflags(size, val1, val2);
+ error = vie_read_register(vm, vcpuid, VM_REG_GUEST_RFLAGS,
+ &rflags);
+ if (error)
+ return (error);
+
+ rflags &= ~RFLAGS_STATUS_BITS;
+ rflags |= rflags2 & RFLAGS_STATUS_BITS;
+ error = vie_update_register(vm, vcpuid, VM_REG_GUEST_RFLAGS,
+ rflags, 8);
+ }
+
+ return (error);
+}
+
+static int
emulate_sub(void *vm, int vcpuid, uint64_t gpa, struct vie *vie,
mem_region_read_t memread, mem_region_write_t memwrite, void *arg)
{
@@ -1543,6 +1730,14 @@
error = emulate_twob_group15(vm, vcpuid, gpa, vie,
memread, memwrite, memarg);
break;
+ case VIE_OP_TYPE_ADD:
+ error = emulate_add(vm, vcpuid, gpa, vie, memread,
+ memwrite, memarg);
+ break;
+ case VIE_OP_TYPE_TEST:
+ error = emulate_test(vm, vcpuid, gpa, vie,
+ memread, memwrite, memarg);
+ break;
default:
error = EINVAL;
break;

18
share/security/patches/EN-19:16/bhyve.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl1cPhRfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cJHuA//cW9cKXRVjNzTpfYVFy5yLbREVsE2nsGzTETuWXhx/aJNoEz6hPo0f169
K2OQfz4rxhaFzA0BbwTRpFeYXRbV6e+iwgcWfNlYKiNpJi5RCMDsKQ4XsaH6gPKi
swqliOl4uHLcuJeGhzkQ1fYyXjGxMJvOqpTs9brOj1btimCF0MJ/j9EpuWVX+lKH
HVt8CyqX6HtixN8WF7ghs6D3hQUamhLNLJanoDicjuxE7uJr3P/ZVrc1ETI1uKO/
LVFM94oXmRDzkMyEkRNFyoYyc0fCSS2FJrDY6EnfqcMs9IrtS2iC7Cjj8zWzEKtR
FEVyCiruDNbQftF7/cMquksqNIhdlifVKGRFT13WvFkm2iVDNypTtO6eXDCHaxZe
Z8KKEoPBoJDux9/VSnt038zLCNVOxrFGaDrupRL2xZTrgmCF56WN8lALNVzmrZlN
0u0RwGM21xgdzt/58zmFfdlMI9hGfbsDTE1Wwj38eZd+qRzR3o+VxMgnFu0vxAcD
R12fi8xOe9QoS13O5OCb3ouxK9mUrd0a56kSBO/rRHt4DD+u+FCN33u/0uBDgI06
Av7p5Hjt0/C89fuFZzMOPD98a0PcSUhdmXOlMAQUotMvhXRbl4nKiGsOVDpmCYz6
pow+Sf971OXGXEWyaf3UBIfhlANMrANAFTNljuhGOoLtQRrpw0w=
=Tmxy
-----END PGP SIGNATURE-----

33
share/security/patches/EN-19:17/ipfw.patch Normal file
View file

@ -0,0 +1,33 @@
--- sbin/ipfw/ipfw2.c.orig
+++ sbin/ipfw/ipfw2.c
@@ -4662,12 +4662,27 @@
case TOK_JAIL:
NEED1("jail requires argument");
{
+ char *end;
int jid;
cmd->opcode = O_JAIL;
- jid = jail_getid(*av);
- if (jid < 0)
- errx(EX_DATAERR, "%s", jail_errmsg);
+ /*
+ * If av is a number, then we'll just pass it as-is. If
+ * it's a name, try to resolve that to a jid.
+ *
+ * We save the jail_getid(3) call for a fallback because
+ * it entails an unconditional trip to the kernel to
+ * either validate a jid or resolve a name to a jid.
+ * This specific token doesn't currently require a
+ * jid to be an active jail, so we save a transition
+ * by simply using a number that we're given.
+ */
+ jid = strtoul(*av, &end, 10);
+ if (*end != '\0') {
+ jid = jail_getid(*av);
+ if (jid < 0)
+ errx(EX_DATAERR, "%s", jail_errmsg);
+ }
cmd32->d[0] = (uint32_t)jid;
cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
av++;

18
share/security/patches/EN-19:17/ipfw.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl1cPhhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cJoZQ//ZnkPQW6u638iGHQh1f7iqJCF/Q1kbdsKTNNvVEmWJPvcaB7kuTN4xXIt
Lji51yk1hlVIrol+mmelvidJTkJbKu/GWR1/T4NlZ8Q0gSVZaGK3AZpMbbDI0ZSP
tyOUD0pPUtsHf6d2oD6ozSAnH+Jk3OxoSwQ6z4PWNGDss69QQcVolpDEC9AXUHJ3
vVBfk2+lJS5L0HmVIJxWgcS3ce3Qg9LB9VXbJRJ/nLsgMKtE6NHc9gYsnCf2e+r2
3LTEeZI36BmsIEk7AB/0QN37ghlmpheyDDgd7HjV/PRJL7yWYvppWV3Jvp2yyWpu
B/zaRKV/KopT+zx0ySiw5yO2R2WBVwNaUpFiRTwPTtJr4P9Ou/v1FkA5demupcUb
RClgAPTRvBzg7KxC62qJ0h8Bf72ZH5ZPFSfrz548qGduUQ1DVxY3W3+K4aHsRCar
E14NSZMHI+o5XPvZ+jEVkQV5rRqO0qU7dt+SHDju/0kEXAp+LK3Sn19dOoyD1b+L
04t0kaYWMvKHHT3SIZMwuXqUU/L3OqrmlI/9/gQe9GSJjkmiABWgxXk8xQPPx+30
Riij6j12PS2BAU4gj8EN+AuSUajemfXmm8oKd/J/IowEHV79Z2MTbJ8lZbD/Es/V
ptH7Uf7Sb17mnYsMg7VrznDztFP0w9UuHETuHQM3PVJGqGiej1o=
=JRT2
-----END PGP SIGNATURE-----

11
share/security/patches/SA-19:22/mbuf.patch Normal file
View file

@ -0,0 +1,11 @@
--- sys/kern/uipc_mbuf2.c.orig
+++ sys/kern/uipc_mbuf2.c
@@ -216,7 +216,7 @@
goto ok;
}
if ((off == 0 || offp) && M_LEADINGSPACE(n->m_next) >= hlen
- && writable) {
+ && writable && n->m_next->m_len >= tlen) {
n->m_next->m_data -= hlen;
n->m_next->m_len += hlen;
bcopy(mtod(n, caddr_t) + off, mtod(n->m_next, caddr_t), hlen);

18
share/security/patches/SA-19:22/mbuf.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl1cPhtfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cKtvg/+Kx/TZnaO5CSvdJP4UCqLAnjYvCd2iJnBLGaqspvZA38uhLguvu0qI6Nb
Ijeg0R26JSruqlTCFD2NZi64b76ErMsymlwSJfbNheNU/Mk16MYNPvvTeAv/0LcU
OHNBNTcQ40mb5whr/yDp6fJk1IE+yDU0nryNaP3gSw91fKO4CrCbmZhK8+XbjudA
YlqmvcbbHlet7DJ4UUONwo1SZpF/l7CmjTFA++rHMxAwPD2jodU3js3kJjgv6JOj
53jqIOyxSJNHRQqjRMjJ3m/Ctf1DHJa8LQkt8dFtMB9bWJ2qeYlJsm8Sosie8hD4
gVPFEZP3m0qF8Zpbm2jXn0QkZ620l/jGmbn2ZfFikB0slSYWO5b2zcl1KiwsVCnv
Bfx9OuIRtrFLmv3yi6lBKdEKZFzXN6/nXf0PdTvwKqszfJIveCMVOtjdbzzxfHwf
r5MiTkLvcytnlpQybn3jCxSi2Kdmsted7BUXlClRN/ySFUxiJpP0HRURsnD3gOtj
LaJS1FWcsrDvShjbXAon+vp59OewnmuJyDGizcRMOsHTK2yl97TR0cq0kcWi3X4R
6O+d8OfKx7goQ03Oa/G4KVJZTzrk9OAXNcV4iZSHCRc9XqaeoZdNe6zu5Acs030J
JGCe0vC23wb7dDYY042rTRBfnvURF8TyYUmWGCWYiUBd85mHxiQ=
=v2wC
-----END PGP SIGNATURE-----

333
share/security/patches/SA-19:23/midi.patch Normal file
View file

@ -0,0 +1,333 @@
--- sys/dev/sound/midi/midi.c.orig
+++ sys/dev/sound/midi/midi.c
@@ -40,6 +40,7 @@
__FBSDID("$FreeBSD$");
#include <sys/param.h>
+#include <sys/systm.h>
#include <sys/queue.h>
#include <sys/kernel.h>
#include <sys/lock.h>
@@ -49,10 +50,8 @@
#include <sys/conf.h>
#include <sys/selinfo.h>
#include <sys/sysctl.h>
-#include <sys/types.h>
#include <sys/malloc.h>
-#include <sys/param.h>
-#include <sys/systm.h>
+#include <sys/sx.h>
#include <sys/proc.h>
#include <sys/fcntl.h>
#include <sys/types.h>
@@ -187,10 +186,9 @@
* /dev/midistat variables and declarations, protected by midistat_lock
*/
-static struct mtx midistat_lock;
+static struct sx midistat_lock;
static int midistat_isopen = 0;
static struct sbuf midistat_sbuf;
-static int midistat_bufptr;
static struct cdev *midistat_dev;
/*
@@ -289,7 +287,7 @@
MIDI_TYPE *buf;
MIDI_DEBUG(1, printf("midiinit: unit %d/%d.\n", unit, channel));
- mtx_lock(&midistat_lock);
+ sx_xlock(&midistat_lock);
/*
* Protect against call with existing unit/channel or auto-allocate a
* new unit number.
@@ -316,13 +314,8 @@
unit = i + 1;
MIDI_DEBUG(1, printf("midiinit #2: unit %d/%d.\n", unit, channel));
- m = malloc(sizeof(*m), M_MIDI, M_NOWAIT | M_ZERO);
- if (m == NULL)
- goto err0;
-
- m->synth = malloc(sizeof(*m->synth), M_MIDI, M_NOWAIT | M_ZERO);
- if (m->synth == NULL)
- goto err1;
+ m = malloc(sizeof(*m), M_MIDI, M_WAITOK | M_ZERO);
+ m->synth = malloc(sizeof(*m->synth), M_MIDI, M_WAITOK | M_ZERO);
kobj_init((kobj_t)m->synth, &midisynth_class);
m->synth->m = m;
kobj_init((kobj_t)m, cls);
@@ -331,7 +324,7 @@
MIDI_DEBUG(1, printf("midiinit queues %d/%d.\n", inqsize, outqsize));
if (!inqsize && !outqsize)
- goto err2;
+ goto err1;
mtx_init(&m->lock, "raw midi", NULL, 0);
mtx_init(&m->qlock, "q raw midi", NULL, 0);
@@ -356,8 +349,7 @@
if ((inqsize && !MIDIQ_BUF(m->inq)) ||
(outqsize && !MIDIQ_BUF(m->outq)))
- goto err3;
-
+ goto err2;
m->busy = 0;
m->flags = 0;
@@ -366,14 +358,14 @@
m->cookie = cookie;
if (MPU_INIT(m, cookie))
- goto err3;
+ goto err2;
mtx_unlock(&m->lock);
mtx_unlock(&m->qlock);
TAILQ_INSERT_TAIL(&midi_devs, m, link);
- mtx_unlock(&midistat_lock);
+ sx_xunlock(&midistat_lock);
m->dev = make_dev(&midi_cdevsw,
MIDIMKMINOR(unit, MIDI_DEV_RAW, channel),
@@ -382,16 +374,19 @@
return m;
-err3: mtx_destroy(&m->qlock);
+err2:
+ mtx_destroy(&m->qlock);
mtx_destroy(&m->lock);
if (MIDIQ_BUF(m->inq))
free(MIDIQ_BUF(m->inq), M_MIDI);
if (MIDIQ_BUF(m->outq))
free(MIDIQ_BUF(m->outq), M_MIDI);
-err2: free(m->synth, M_MIDI);
-err1: free(m, M_MIDI);
-err0: mtx_unlock(&midistat_lock);
+err1:
+ free(m->synth, M_MIDI);
+ free(m, M_MIDI);
+err0:
+ sx_xunlock(&midistat_lock);
MIDI_DEBUG(1, printf("midi_init ended in error\n"));
return NULL;
}
@@ -409,7 +404,7 @@
int err;
err = EBUSY;
- mtx_lock(&midistat_lock);
+ sx_xlock(&midistat_lock);
mtx_lock(&m->lock);
if (m->busy) {
if (!(m->rchan || m->wchan))
@@ -428,8 +423,10 @@
if (!err)
goto exit;
-err: mtx_unlock(&m->lock);
-exit: mtx_unlock(&midistat_lock);
+err:
+ mtx_unlock(&m->lock);
+exit:
+ sx_xunlock(&midistat_lock);
return err;
}
@@ -941,27 +938,22 @@
int error;
MIDI_DEBUG(1, printf("midistat_open\n"));
- mtx_lock(&midistat_lock);
+ sx_xlock(&midistat_lock);
if (midistat_isopen) {
- mtx_unlock(&midistat_lock);
+ sx_xunlock(&midistat_lock);
return EBUSY;
}
midistat_isopen = 1;
- mtx_unlock(&midistat_lock);
-
if (sbuf_new(&midistat_sbuf, NULL, 4096, SBUF_AUTOEXTEND) == NULL) {
error = ENXIO;
- mtx_lock(&midistat_lock);
goto out;
}
- mtx_lock(&midistat_lock);
- midistat_bufptr = 0;
error = (midistat_prepare(&midistat_sbuf) > 0) ? 0 : ENOMEM;
-
-out: if (error)
+out:
+ if (error)
midistat_isopen = 0;
- mtx_unlock(&midistat_lock);
+ sx_xunlock(&midistat_lock);
return error;
}
@@ -969,40 +961,40 @@
midistat_close(struct cdev *i_dev, int flags, int mode, struct thread *td)
{
MIDI_DEBUG(1, printf("midistat_close\n"));
- mtx_lock(&midistat_lock);
+ sx_xlock(&midistat_lock);
if (!midistat_isopen) {
- mtx_unlock(&midistat_lock);
+ sx_xunlock(&midistat_lock);
return EBADF;
}
sbuf_delete(&midistat_sbuf);
midistat_isopen = 0;
-
- mtx_unlock(&midistat_lock);
+ sx_xunlock(&midistat_lock);
return 0;
}
static int
-midistat_read(struct cdev *i_dev, struct uio *buf, int flag)
+midistat_read(struct cdev *i_dev, struct uio *uio, int flag)
{
- int l, err;
+ long l;
+ int err;
MIDI_DEBUG(4, printf("midistat_read\n"));
- mtx_lock(&midistat_lock);
+ sx_xlock(&midistat_lock);
if (!midistat_isopen) {
- mtx_unlock(&midistat_lock);
+ sx_xunlock(&midistat_lock);
return EBADF;
}
- l = min(buf->uio_resid, sbuf_len(&midistat_sbuf) - midistat_bufptr);
+ if (uio->uio_offset < 0 || uio->uio_offset > sbuf_len(&midistat_sbuf)) {
+ sx_xunlock(&midistat_lock);
+ return EINVAL;
+ }
err = 0;
+ l = lmin(uio->uio_resid, sbuf_len(&midistat_sbuf) - uio->uio_offset);
if (l > 0) {
- mtx_unlock(&midistat_lock);
- err = uiomove(sbuf_data(&midistat_sbuf) + midistat_bufptr, l,
- buf);
- mtx_lock(&midistat_lock);
- } else
- l = 0;
- midistat_bufptr += l;
- mtx_unlock(&midistat_lock);
+ err = uiomove(sbuf_data(&midistat_sbuf) + uio->uio_offset, l,
+ uio);
+ }
+ sx_xunlock(&midistat_lock);
return err;
}
@@ -1015,7 +1007,7 @@
{
struct snd_midi *m;
- mtx_assert(&midistat_lock, MA_OWNED);
+ sx_assert(&midistat_lock, SA_XLOCKED);
sbuf_printf(s, "FreeBSD Midi Driver (midi2)\n");
if (TAILQ_EMPTY(&midi_devs)) {
@@ -1378,8 +1370,7 @@
static int
midi_destroy(struct snd_midi *m, int midiuninit)
{
-
- mtx_assert(&midistat_lock, MA_OWNED);
+ sx_assert(&midistat_lock, SA_XLOCKED);
mtx_assert(&m->lock, MA_OWNED);
MIDI_DEBUG(3, printf("midi_destroy\n"));
@@ -1405,8 +1396,8 @@
static int
midi_load(void)
{
- mtx_init(&midistat_lock, "midistat lock", NULL, 0);
- TAILQ_INIT(&midi_devs); /* Initialize the queue. */
+ sx_init(&midistat_lock, "midistat lock");
+ TAILQ_INIT(&midi_devs);
midistat_dev = make_dev(&midistat_cdevsw,
MIDIMKMINOR(0, MIDI_DEV_MIDICTL, 0),
@@ -1423,7 +1414,7 @@
MIDI_DEBUG(1, printf("midi_unload()\n"));
retval = EBUSY;
- mtx_lock(&midistat_lock);
+ sx_xlock(&midistat_lock);
if (midistat_isopen)
goto exit0;
@@ -1436,20 +1427,19 @@
if (retval)
goto exit1;
}
-
- mtx_unlock(&midistat_lock); /* XXX */
-
+ sx_xunlock(&midistat_lock);
destroy_dev(midistat_dev);
+
/*
* Made it here then unload is complete
*/
- mtx_destroy(&midistat_lock);
+ sx_destroy(&midistat_lock);
return 0;
exit1:
mtx_unlock(&m->lock);
exit0:
- mtx_unlock(&midistat_lock);
+ sx_xunlock(&midistat_lock);
if (retval)
MIDI_DEBUG(2, printf("midi_unload: failed\n"));
return retval;
@@ -1498,13 +1488,11 @@
int retval = 0;
struct snd_midi *m;
- mtx_lock(&midistat_lock);
-
+ sx_xlock(&midistat_lock);
TAILQ_FOREACH(m, &midi_devs, link) {
retval++;
}
-
- mtx_unlock(&midistat_lock);
+ sx_xunlock(&midistat_lock);
return retval;
}
@@ -1520,17 +1508,15 @@
struct snd_midi *m;
int retval = 0;
- mtx_lock(&midistat_lock);
-
+ sx_xlock(&midistat_lock);
TAILQ_FOREACH(m, &midi_devs, link) {
if (unit == retval) {
- mtx_unlock(&midistat_lock);
+ sx_xunlock(&midistat_lock);
return (kobj_t)m->synth;
}
retval++;
}
-
- mtx_unlock(&midistat_lock);
+ sx_xunlock(&midistat_lock);
return NULL;
}

18
share/security/patches/SA-19:23/midi.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl1cPh5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cKlVg//VZ6BqKXoW5f0HEA3wVdn9if3Fxux4q4hJw80AAJ+Zq+zF8zKCgZRaOS9
nO+q5zj54IdSBKyGScqJ0owYE2gKdqdXz1/uYTz8cxjiUV+/JNtyPydHrt2eznYI
9vbeShyCI48BnR74b9EiFY/2Naq0YICv3CHBR9oWSaPkYdLPdF4QSpKwrRSID0Ok
bnomM8kGAUzpAtPoCMTpn9CJT+J/DCyXzvl3Npcn6m/iZCVtx94rktmWaoTYRNeD
FkG77hMNkBQFJ3IkJjFJKSswwCky87F8u/2TF6vDyvYvfzpuuOFBS09AET8TmutV
AmjA64tKltOALunaB5y0w/xXQiL/EoSY29UdH173xjh7/U/OFBA0cL//lFQOiTiE
LuT0MCxsvk2A6WFglQTw8QMtcx3hez8GYzCmy/gJgVv6889c/l61eYR1TUqxNUKJ
+lzi9q1tX7M1vZmNwEUJLavwvSCJfqMMLO75C0Az8VKfI8HJDLrAeexrLWYK6Ayz
/TRJx8GHS3lHNcVlBFg1LrvPdDGkOoO9EAIPvP3aUG6d256J/zVUHxvb6iFA4YG5
9ptHQIXtqGGQTfNUl4WEUjb5+7U9C+QkuW7DCQTcuKEEjohA0SoY77/QU/ZrKX4+
/G5wlR2hZ6Q9T9QVm1SMAY+rpu4znVWdObt2wsvgSbcNZKsyfF0=
=Ditr
-----END PGP SIGNATURE-----

19
share/security/patches/SA-19:24/mqueuefs.patch Normal file
View file

@ -0,0 +1,19 @@
--- sys/kern/uipc_mqueue.c.orig
+++ sys/kern/uipc_mqueue.c
@@ -2806,7 +2806,7 @@
if (uap->abs_timeout != NULL) {
error = copyin(uap->abs_timeout, &ets32, sizeof(ets32));
if (error != 0)
- return (error);
+ goto out;
CP(ets32, ets, tv_sec);
CP(ets32, ets, tv_nsec);
abs_timeout = &ets;
@@ -2815,6 +2815,7 @@
waitok = !(fp->f_flag & O_NONBLOCK);
error = mqueue_send(mq, uap->msg_ptr, uap->msg_len,
uap->msg_prio, waitok, abs_timeout);
+out:
fdrop(fp, td);
return (error);
}

18
share/security/patches/SA-19:24/mqueuefs.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl1cPiJfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cKBYQ//SP6pcenVbNJrwNgR25HXKLfJ4osBPxMSVPE3nN5inPfJWAVnL1gNGQSR
E01Pmxkz/4DrBjPhVlXUkFY7WCZu6QYgBRjFb8WadTGtUS+zg+/hz+/517OclRms
KvKwZqnYVKDD2141X7Ign4h5EWQek6gkkhOmkMg6ROa2nl932l9RKguRvd6V1hDO
c+JYhnpcOCj+lTLVF8ZTnOXMgVEVJs9RsBLWlwesDMLKCM4uSAY+p5IoXYiBvUVM
hqd38u/Lr2QrijWpXwDk4XylxzWoUY+ben4ODtAPuVD0KxyA5h+39xRKCqrgrUfF
3rYRi/ytSWVElVetitNAJcLrsv1Ho7mhKdTBuVj7zEXto+qtpxaJ/dbYaTUl5dwE
mQzLOP/XcRpMr2Ryf1MmUxsRlF11g2GcKn2dufycPtiRuTzSDtVmHTLUK1hFsXvT
QO6Mvfml+far/4ZPvn6Q6KwBoudiUpUiEkwPt2/Nb6ynnHWdUk4av6Kbcu7UlkiR
a+oPTDlos+p0/IKyjwuBgOFjXC2OKZpELjgL3pmPrhOTEPKLduiFhfsiywN04ofx
Zh0065kQFnSPenUAsO8s8WNx2gf+JhqG3HZs2Die6lTRmxJsiHYGZ8IpNaPig+W4
VVJe+iQ7NTQ3gGieWHwnZd2DTvmhoUWnh1usw2XuX8Atug8JCuI=
=Mzmh
-----END PGP SIGNATURE-----