ifioctl(9): Don't touch ifconf or ifreq until command is validated.

sys_ioctl validates the data pointer according to the command's size
and direction. But userland may ioctl commands other than
OSIOCGIFCONF or OOSIOCGIFCONF -- and if userland passes an IOC_VOID
command, the argument is passed through verbatim and may be null.

Reported-by: syzbot+19b1bf83e5481273eafc@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=f4c91a7dcd31901c80d91af6ed01456faf0a7286

Reported-by: syzbot+442c033feb784d055185@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=4a3a4b92dbe9695046ff17a5474cef52aed23e0b

Reported-by: syzbot+4c87d0cdf7025741ea7a@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=3e5f42c998e43ad42da40dec3c7873e6aae187e4

Don't accept negative value.

Reported-by: syzbot+e71a77402d6668f1868d@syzkaller.appspotmail.com

pass the address of the field, instead of relying on it being the first
field of the structure, no functional change

branches: 1.21.2;
Rather than keeping a separate mutex, condvar, and pserialize for each
module hook, we can share a common set of synchronization structures.
This cuts the amount of cacheline_aligned data for these structures by
50%.

Note that we still have a per-hook localcount, since we need to count
individual references.

As discussed with riastradh@

Welcome to 9.99.22 !

branches: 1.20.2;
KNF. No functional change.

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks! This is the compat code part
pointed out by ozaki-r@

Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Merge the [pgoyette-compat] branch

branches: 1.16.2;
provide vectors for the ifconf compat code and ifdatareq compat code.

branches: 1.15.2;
#idef the label next_ifa: just like the only goto using it.

Fix and make consistent of usages of psz/psref in ifconf variants

branches: 1.13.6;
Use if_acquire and if_release instead of using psref API directly

- Provide if_release for consistency to if_acquire
- Use if_acquire and if_release for ifp iterations
- Make ifnet_psref_class static

branches: 1.12.2;
Apply pserialize and psref to struct ifaddr and its variants

This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.

branches: 1.11.2;
Switch the address list of intefaces to pslist(9)

As usual, we leave the old list to avoid breaking kvm(3) users.

Use curlwp_bind and curlwp_bindx instead of open-coding LP_BOUND

Protect ifnet list with psz and psref

The change ensures that ifnet objects in the ifnet list aren't freed during
list iterations by using pserialize(9) and psref(9).

Note that the change adds a pslist(9) for ifnet but doesn't remove the
original ifnet list (ifnet_list) to avoid breaking kvm(3) users. We
shouldn't use the original list in the kernel anymore.

branches: 1.8.2;
Tweak ifconf variants

The tweaks make the code intention clear and make further changes easy.

No functional change.

branches: 1.7.16; 1.7.32; 1.7.34; 1.7.38;
Remove includes <sys/mount.h> and <sys/sched.h> added for <sys/syscallargs.h>.
Now they are handled by $sysarghdrextra in sys/kern/syscalls.conf.

branches: 1.6.38; 1.6.44;
Use IFADDR_EMPTY().

Use IFADDR_FOREACH().

branches: 1.4.2; 1.4.4; 1.4.10; 1.4.12; 1.4.14; 1.4.20; 1.4.22;
Reduce difference between compat_ifconf() and ifconf():
- exit on error rather than proceeding to next interface.
- make code simpler.

Move the nasty ifdefs in one place. Requested by ad and dyoung.

wrap the whole function in COMPAT_40

Add a sockaddr_storage member to "struct ifreq" maintaining backwards
compatibility with the older ioctls. This avoids stack smashing and
abuse of "struct sockaddr" when ioctls placed "struct sockaddr_foo's" that
were longer than "struct sockaddr".
XXX: Some of the emulations might be broken; I tried to add code for
them but I did not test them.

Don't accept negative value.

Reported-by: syzbot+e71a77402d6668f1868d@syzkaller.appspotmail.com

pass the address of the field, instead of relying on it being the first
field of the structure, no functional change

branches: 1.21.2;
Rather than keeping a separate mutex, condvar, and pserialize for each
module hook, we can share a common set of synchronization structures.
This cuts the amount of cacheline_aligned data for these structures by
50%.

Note that we still have a per-hook localcount, since we need to count
individual references.

As discussed with riastradh@

Welcome to 9.99.22 !

branches: 1.20.2;
KNF. No functional change.

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks! This is the compat code part
pointed out by ozaki-r@

Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Merge the [pgoyette-compat] branch

branches: 1.16.2;
provide vectors for the ifconf compat code and ifdatareq compat code.

branches: 1.15.2;
#idef the label next_ifa: just like the only goto using it.

Fix and make consistent of usages of psz/psref in ifconf variants

branches: 1.13.6;
Use if_acquire and if_release instead of using psref API directly

- Provide if_release for consistency to if_acquire
- Use if_acquire and if_release for ifp iterations
- Make ifnet_psref_class static

branches: 1.12.2;
Apply pserialize and psref to struct ifaddr and its variants

This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.

branches: 1.11.2;
Switch the address list of intefaces to pslist(9)

As usual, we leave the old list to avoid breaking kvm(3) users.

Use curlwp_bind and curlwp_bindx instead of open-coding LP_BOUND

Protect ifnet list with psz and psref

The change ensures that ifnet objects in the ifnet list aren't freed during
list iterations by using pserialize(9) and psref(9).

Note that the change adds a pslist(9) for ifnet but doesn't remove the
original ifnet list (ifnet_list) to avoid breaking kvm(3) users. We
shouldn't use the original list in the kernel anymore.

branches: 1.8.2;
Tweak ifconf variants

The tweaks make the code intention clear and make further changes easy.

No functional change.

branches: 1.7.16; 1.7.32; 1.7.34; 1.7.38;
Remove includes <sys/mount.h> and <sys/sched.h> added for <sys/syscallargs.h>.
Now they are handled by $sysarghdrextra in sys/kern/syscalls.conf.

branches: 1.6.38; 1.6.44;
Use IFADDR_EMPTY().

Use IFADDR_FOREACH().

branches: 1.4.2; 1.4.4; 1.4.10; 1.4.12; 1.4.14; 1.4.20; 1.4.22;
Reduce difference between compat_ifconf() and ifconf():
- exit on error rather than proceeding to next interface.
- make code simpler.

Move the nasty ifdefs in one place. Requested by ad and dyoung.

wrap the whole function in COMPAT_40

Add a sockaddr_storage member to "struct ifreq" maintaining backwards
compatibility with the older ioctls. This avoids stack smashing and
abuse of "struct sockaddr" when ioctls placed "struct sockaddr_foo's" that
were longer than "struct sockaddr".
XXX: Some of the emulations might be broken; I tried to add code for
them but I did not test them.

pass the address of the field, instead of relying on it being the first
field of the structure, no functional change

Rather than keeping a separate mutex, condvar, and pserialize for each
module hook, we can share a common set of synchronization structures.
This cuts the amount of cacheline_aligned data for these structures by
50%.

Note that we still have a per-hook localcount, since we need to count
individual references.

As discussed with riastradh@

Welcome to 9.99.22 !

KNF. No functional change.

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks! This is the compat code part
pointed out by ozaki-r@

Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Merge the [pgoyette-compat] branch

branches: 1.16.2;
provide vectors for the ifconf compat code and ifdatareq compat code.

branches: 1.15.2;
#idef the label next_ifa: just like the only goto using it.

Fix and make consistent of usages of psz/psref in ifconf variants

branches: 1.13.6;
Use if_acquire and if_release instead of using psref API directly

- Provide if_release for consistency to if_acquire
- Use if_acquire and if_release for ifp iterations
- Make ifnet_psref_class static

branches: 1.12.2;
Apply pserialize and psref to struct ifaddr and its variants

This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.

branches: 1.11.2;
Switch the address list of intefaces to pslist(9)

As usual, we leave the old list to avoid breaking kvm(3) users.

Use curlwp_bind and curlwp_bindx instead of open-coding LP_BOUND

Protect ifnet list with psz and psref

The change ensures that ifnet objects in the ifnet list aren't freed during
list iterations by using pserialize(9) and psref(9).

Note that the change adds a pslist(9) for ifnet but doesn't remove the
original ifnet list (ifnet_list) to avoid breaking kvm(3) users. We
shouldn't use the original list in the kernel anymore.

branches: 1.8.2;
Tweak ifconf variants

The tweaks make the code intention clear and make further changes easy.

No functional change.

branches: 1.7.16; 1.7.32; 1.7.34; 1.7.38;
Remove includes <sys/mount.h> and <sys/sched.h> added for <sys/syscallargs.h>.
Now they are handled by $sysarghdrextra in sys/kern/syscalls.conf.

branches: 1.6.38; 1.6.44;
Use IFADDR_EMPTY().

Use IFADDR_FOREACH().

branches: 1.4.2; 1.4.4; 1.4.10; 1.4.12; 1.4.14; 1.4.20; 1.4.22;
Reduce difference between compat_ifconf() and ifconf():
- exit on error rather than proceeding to next interface.
- make code simpler.

Move the nasty ifdefs in one place. Requested by ad and dyoung.

wrap the whole function in COMPAT_40

Add a sockaddr_storage member to "struct ifreq" maintaining backwards
compatibility with the older ioctls. This avoids stack smashing and
abuse of "struct sockaddr" when ioctls placed "struct sockaddr_foo's" that
were longer than "struct sockaddr".
XXX: Some of the emulations might be broken; I tried to add code for
them but I did not test them.

Rather than keeping a separate mutex, condvar, and pserialize for each
module hook, we can share a common set of synchronization structures.
This cuts the amount of cacheline_aligned data for these structures by
50%.

Note that we still have a per-hook localcount, since we need to count
individual references.

As discussed with riastradh@

Welcome to 9.99.22 !

KNF. No functional change.

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks! This is the compat code part
pointed out by ozaki-r@

Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Merge the [pgoyette-compat] branch

branches: 1.16.2;
provide vectors for the ifconf compat code and ifdatareq compat code.

branches: 1.15.2;
#idef the label next_ifa: just like the only goto using it.

Fix and make consistent of usages of psz/psref in ifconf variants

branches: 1.13.6;
Use if_acquire and if_release instead of using psref API directly

- Provide if_release for consistency to if_acquire
- Use if_acquire and if_release for ifp iterations
- Make ifnet_psref_class static

branches: 1.12.2;
Apply pserialize and psref to struct ifaddr and its variants

This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.

branches: 1.11.2;
Switch the address list of intefaces to pslist(9)

As usual, we leave the old list to avoid breaking kvm(3) users.

Use curlwp_bind and curlwp_bindx instead of open-coding LP_BOUND

Protect ifnet list with psz and psref

The change ensures that ifnet objects in the ifnet list aren't freed during
list iterations by using pserialize(9) and psref(9).

Note that the change adds a pslist(9) for ifnet but doesn't remove the
original ifnet list (ifnet_list) to avoid breaking kvm(3) users. We
shouldn't use the original list in the kernel anymore.

branches: 1.8.2;
Tweak ifconf variants

The tweaks make the code intention clear and make further changes easy.

No functional change.

branches: 1.7.16; 1.7.32; 1.7.34; 1.7.38;
Remove includes <sys/mount.h> and <sys/sched.h> added for <sys/syscallargs.h>.
Now they are handled by $sysarghdrextra in sys/kern/syscalls.conf.

branches: 1.6.38; 1.6.44;
Use IFADDR_EMPTY().

Use IFADDR_FOREACH().

branches: 1.4.2; 1.4.4; 1.4.10; 1.4.12; 1.4.14; 1.4.20; 1.4.22;
Reduce difference between compat_ifconf() and ifconf():
- exit on error rather than proceeding to next interface.
- make code simpler.

Move the nasty ifdefs in one place. Requested by ad and dyoung.

wrap the whole function in COMPAT_40

Add a sockaddr_storage member to "struct ifreq" maintaining backwards
compatibility with the older ioctls. This avoids stack smashing and
abuse of "struct sockaddr" when ioctls placed "struct sockaddr_foo's" that
were longer than "struct sockaddr".
XXX: Some of the emulations might be broken; I tried to add code for
them but I did not test them.

KNF. No functional change.

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks! This is the compat code part
pointed out by ozaki-r@

Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Merge the [pgoyette-compat] branch

provide vectors for the ifconf compat code and ifdatareq compat code.

branches: 1.15.2;
#idef the label next_ifa: just like the only goto using it.

Fix and make consistent of usages of psz/psref in ifconf variants

branches: 1.13.6;
Use if_acquire and if_release instead of using psref API directly

- Provide if_release for consistency to if_acquire
- Use if_acquire and if_release for ifp iterations
- Make ifnet_psref_class static

branches: 1.12.2;
Apply pserialize and psref to struct ifaddr and its variants

This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.

branches: 1.11.2;
Switch the address list of intefaces to pslist(9)

As usual, we leave the old list to avoid breaking kvm(3) users.

Use curlwp_bind and curlwp_bindx instead of open-coding LP_BOUND

Protect ifnet list with psz and psref

The change ensures that ifnet objects in the ifnet list aren't freed during
list iterations by using pserialize(9) and psref(9).

Note that the change adds a pslist(9) for ifnet but doesn't remove the
original ifnet list (ifnet_list) to avoid breaking kvm(3) users. We
shouldn't use the original list in the kernel anymore.

branches: 1.8.2;
Tweak ifconf variants

The tweaks make the code intention clear and make further changes easy.

No functional change.

branches: 1.7.16; 1.7.32; 1.7.34; 1.7.38;
Remove includes <sys/mount.h> and <sys/sched.h> added for <sys/syscallargs.h>.
Now they are handled by $sysarghdrextra in sys/kern/syscalls.conf.

branches: 1.6.38; 1.6.44;
Use IFADDR_EMPTY().

Use IFADDR_FOREACH().

branches: 1.4.2; 1.4.4; 1.4.10; 1.4.12; 1.4.14; 1.4.20; 1.4.22;
Reduce difference between compat_ifconf() and ifconf():
- exit on error rather than proceeding to next interface.
- make code simpler.

Move the nasty ifdefs in one place. Requested by ad and dyoung.

wrap the whole function in COMPAT_40

Add a sockaddr_storage member to "struct ifreq" maintaining backwards
compatibility with the older ioctls. This avoids stack smashing and
abuse of "struct sockaddr" when ioctls placed "struct sockaddr_foo's" that
were longer than "struct sockaddr".
XXX: Some of the emulations might be broken; I tried to add code for
them but I did not test them.

#idef the label next_ifa: just like the only goto using it.

Fix and make consistent of usages of psz/psref in ifconf variants

branches: 1.13.6;
Use if_acquire and if_release instead of using psref API directly

- Provide if_release for consistency to if_acquire
- Use if_acquire and if_release for ifp iterations
- Make ifnet_psref_class static

branches: 1.12.2;
Apply pserialize and psref to struct ifaddr and its variants

This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.

branches: 1.11.2;
Switch the address list of intefaces to pslist(9)

As usual, we leave the old list to avoid breaking kvm(3) users.

Use curlwp_bind and curlwp_bindx instead of open-coding LP_BOUND

Protect ifnet list with psz and psref

The change ensures that ifnet objects in the ifnet list aren't freed during
list iterations by using pserialize(9) and psref(9).

Note that the change adds a pslist(9) for ifnet but doesn't remove the
original ifnet list (ifnet_list) to avoid breaking kvm(3) users. We
shouldn't use the original list in the kernel anymore.

branches: 1.8.2;
Tweak ifconf variants

The tweaks make the code intention clear and make further changes easy.

No functional change.

branches: 1.7.16;
Remove includes <sys/mount.h> and <sys/sched.h> added for <sys/syscallargs.h>.
Now they are handled by $sysarghdrextra in sys/kern/syscalls.conf.

branches: 1.6.38; 1.6.44;
Use IFADDR_EMPTY().

Use IFADDR_FOREACH().

branches: 1.4.2; 1.4.4; 1.4.10; 1.4.12; 1.4.14; 1.4.20; 1.4.22;
Reduce difference between compat_ifconf() and ifconf():
- exit on error rather than proceeding to next interface.
- make code simpler.

Move the nasty ifdefs in one place. Requested by ad and dyoung.

wrap the whole function in COMPAT_40

Add a sockaddr_storage member to "struct ifreq" maintaining backwards
compatibility with the older ioctls. This avoids stack smashing and
abuse of "struct sockaddr" when ioctls placed "struct sockaddr_foo's" that
were longer than "struct sockaddr".
XXX: Some of the emulations might be broken; I tried to add code for
them but I did not test them.

Use if_acquire and if_release instead of using psref API directly

- Provide if_release for consistency to if_acquire
- Use if_acquire and if_release for ifp iterations
- Make ifnet_psref_class static

Apply pserialize and psref to struct ifaddr and its variants

This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.

branches: 1.11.2;
Switch the address list of intefaces to pslist(9)

As usual, we leave the old list to avoid breaking kvm(3) users.

Use curlwp_bind and curlwp_bindx instead of open-coding LP_BOUND

Protect ifnet list with psz and psref

The change ensures that ifnet objects in the ifnet list aren't freed during
list iterations by using pserialize(9) and psref(9).

Note that the change adds a pslist(9) for ifnet but doesn't remove the
original ifnet list (ifnet_list) to avoid breaking kvm(3) users. We
shouldn't use the original list in the kernel anymore.

branches: 1.8.2;
Tweak ifconf variants

The tweaks make the code intention clear and make further changes easy.

No functional change.

Remove includes <sys/mount.h> and <sys/sched.h> added for <sys/syscallargs.h>.
Now they are handled by $sysarghdrextra in sys/kern/syscalls.conf.

branches: 1.6.38; 1.6.44;
Use IFADDR_EMPTY().

Use IFADDR_FOREACH().

branches: 1.4.2; 1.4.4; 1.4.10; 1.4.12; 1.4.14; 1.4.20; 1.4.22;
Reduce difference between compat_ifconf() and ifconf():
- exit on error rather than proceeding to next interface.
- make code simpler.

Move the nasty ifdefs in one place. Requested by ad and dyoung.

wrap the whole function in COMPAT_40

Add a sockaddr_storage member to "struct ifreq" maintaining backwards
compatibility with the older ioctls. This avoids stack smashing and
abuse of "struct sockaddr" when ioctls placed "struct sockaddr_foo's" that
were longer than "struct sockaddr".
XXX: Some of the emulations might be broken; I tried to add code for
them but I did not test them.

Apply pserialize and psref to struct ifaddr and its variants

This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.

branches: 1.11.2;
Switch the address list of intefaces to pslist(9)

As usual, we leave the old list to avoid breaking kvm(3) users.

Use curlwp_bind and curlwp_bindx instead of open-coding LP_BOUND

Protect ifnet list with psz and psref

The change ensures that ifnet objects in the ifnet list aren't freed during
list iterations by using pserialize(9) and psref(9).

Note that the change adds a pslist(9) for ifnet but doesn't remove the
original ifnet list (ifnet_list) to avoid breaking kvm(3) users. We
shouldn't use the original list in the kernel anymore.

branches: 1.8.2;
Tweak ifconf variants

The tweaks make the code intention clear and make further changes easy.

No functional change.

Remove includes <sys/mount.h> and <sys/sched.h> added for <sys/syscallargs.h>.
Now they are handled by $sysarghdrextra in sys/kern/syscalls.conf.

branches: 1.6.38; 1.6.44;
Use IFADDR_EMPTY().

Use IFADDR_FOREACH().

branches: 1.4.2; 1.4.4; 1.4.10; 1.4.12; 1.4.14; 1.4.20; 1.4.22;
Reduce difference between compat_ifconf() and ifconf():
- exit on error rather than proceeding to next interface.
- make code simpler.

Move the nasty ifdefs in one place. Requested by ad and dyoung.

wrap the whole function in COMPAT_40

Add a sockaddr_storage member to "struct ifreq" maintaining backwards
compatibility with the older ioctls. This avoids stack smashing and
abuse of "struct sockaddr" when ioctls placed "struct sockaddr_foo's" that
were longer than "struct sockaddr".
XXX: Some of the emulations might be broken; I tried to add code for
them but I did not test them.