kgess-mirror/freebsd-src
1
0
Fork 0
mirror of https://git.freebsd.org/src.git synced 2026-01-11 19:57:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
freebsd-src/usr.sbin/bhyve
History
Exact
Jack Bendtsen 7631790422 Fix NULL deref segfault in bhyve's usb_mouse.c 
Some of the cases inside umouse_request() (usr.sbin/bhyve/usb_mouse.c)
use the data component of an event, while only partially checking if
it's NULL. 'data' has a NULL check, but then 'data' is immediately
deferenced anyway after the check regardless of if it's NULL or not.

For example:
	case UREQ(UR_GET_STATUS, UT_READ_INTERFACE):
	case UREQ(UR_GET_STATUS, UT_READ_ENDPOINT):
		DPRINTF(("umouse: (UR_GET_STATUS, UT_READ_INTERFACE)"));
		if (data != NULL && len > 1) {
			USETW(udata, 0);
			data->blen = len - 2;
			data->bdone += 2;
		}
		eshort = data->blen > 0;
		break;

There are actually four occurrences of this same bug, each in a
different case in this switch block.

Signed-off-by: Jack Bendtsen <jackdbendtsen@gmail.com>
PR: 282237
Reviewed by: imp, jhb, vexeduxr
MFC After: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/1728
2026-01-09 13:17:13 -07:00
..
aarch64 bhyve: improve console error reporting on arm64 2026-01-07 18:06:45 +01:00
amd64 bhyve: Introduce monitor mode 2025-12-17 15:08:32 +01:00
gdb Update Makefile.depend files 2024-10-14 10:26:17 -07:00
kbdlayout Remove residual blank line at start of Makefile 2024-07-15 16:43:39 -06:00
riscv bhyve: Introduce monitor mode 2025-12-17 15:08:32 +01:00
slirp bhyve: support MTU configuration for SLIRP net backend 2026-01-08 18:01:13 +01:00
acpi.c bhyve: Add support for specifying guest NUMA configuration 2025-07-27 18:31:48 +02:00
acpi.h bhyve/acpi: Mark dsdt_line as 'printflike' 2025-07-27 18:31:49 +02:00
acpi_device.c
acpi_device.h
ahci.h
audio.c bhyve/audio.c: avoid re-calculating the length of dev_name 2023-12-26 09:36:31 -07:00
audio.h
basl.c
basl.h
bhyve.8 bhyve: support MTU configuration for SLIRP net backend 2026-01-08 18:01:13 +01:00
bhyve_config.5 bhyve: add UNIX domain socket support to rfb 2026-01-08 15:24:52 +00:00
bhyvegc.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
bhyvegc.h
bhyverun.c bhyve: Introduce monitor mode 2025-12-17 15:08:32 +01:00
bhyverun.h bhyve: Eliminate exit status magic numbers 2025-12-17 15:08:32 +01:00
block_if.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
block_if.h
bootrom.c bhyve: Add support for specifying guest NUMA configuration 2025-07-27 18:31:48 +02:00
bootrom.h bhyve: Make boot ROM handling more consistent 2024-08-19 13:55:47 +00:00
config.c
config.h
console.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
console.h
debug.h
gdb.c bhyve: Eliminate exit status magic numbers 2025-12-17 15:08:32 +01:00
gdb.h bhyve: refactor gdbstub to enable single-stepping on AMD CPUs 2023-12-12 15:28:59 -08:00
hda_codec.c bhyve: improve bounds checks in hda_codec 2024-10-03 17:14:11 -04:00
hda_reg.h
hdac_reg.h
iov.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
iov.h
ipc.h
Makefile libuvmem: usermode port of vmem(9) 2025-12-02 05:41:13 +02:00
Makefile.depend
Makefile.depend.options
mem.c bhyve: make code to handle non-backed memory accesses MD 2025-05-15 17:01:40 +03:00
mem.h bhyve: make code to handle non-backed memory accesses MD 2025-05-15 17:01:40 +03:00
mem_md.c bhyve: make code to handle non-backed memory accesses MD 2025-05-15 17:01:40 +03:00
mevent.c bhyve: Eliminate exit status magic numbers 2025-12-17 15:08:32 +01:00
mevent.h bhyve: Extend mevent to support updating timers 2024-04-10 11:17:56 -04:00
mevent_test.c bhyve: Eliminate exit status magic numbers 2025-12-17 15:08:32 +01:00
net_backend_netgraph.c bhyve: Split backends into separate files 2023-11-22 15:18:46 -05:00
net_backend_netmap.c bhyve: Split backends into separate files 2023-11-22 15:18:46 -05:00
net_backend_slirp.c bhyve: support MTU configuration for SLIRP net backend 2026-01-08 18:01:13 +01:00
net_backends.c bhyve: add support for ng_device network backend 2025-10-27 12:46:47 +00:00
net_backends.h bhyve: Split backends into separate files 2023-11-22 15:18:46 -05:00
net_backends_priv.h bhyve: Split backends into separate files 2023-11-22 15:18:46 -05:00
net_utils.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
net_utils.h
pci_ahci.c bhyve ahci: Improve robustness of TRIM handling 2024-10-24 10:18:09 -04:00
pci_e82545.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
pci_emul.c bhyve: Add support for specifying guest NUMA configuration 2025-07-27 18:31:48 +02:00
pci_emul.h bhyve: Support legacy PCI interrupts on arm64 2024-04-10 11:17:56 -04:00
pci_fbuf.c bhyve: add UNIX domain socket support to rfb 2026-01-08 15:24:52 +00:00
pci_hda.c bhyve: validate corb->wp to avoid infinite loop 2024-09-22 07:25:02 -04:00
pci_hda.h
pci_hostbridge.c
pci_irq.h bhyve/riscv: Initial import. 2024-10-31 20:24:12 +00:00
pci_nvme.c bhyve/nvme: Fix Infinite loop in queue processing 2024-10-13 06:58:50 -07:00
pci_passthru.c bhyve: add interface to protect BAR regions of passthru devices 2025-08-05 16:02:09 +02:00
pci_passthru.h bhyve: add interface to protect BAR regions of passthru devices 2025-08-05 16:02:09 +02:00
pci_passthru_quirks.c bhyve: assign a valid INTPIN to NVIDIA GPUs 2025-09-16 08:55:09 +02:00
pci_uart.c bhyve: pci-uart needs to also set subclass and function 2025-12-11 10:11:50 +02:00
pci_virtio_9p.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
pci_virtio_block.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
pci_virtio_console.c bhyve: avoid buffer overflow in pci_vtcon_control_send 2024-10-15 16:54:19 -04:00
pci_virtio_input.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
pci_virtio_net.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
pci_virtio_rnd.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
pci_virtio_scsi.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
pci_xhci.c xhci: Correct name of HCCPARAMS Register 2025-12-05 10:17:45 +00:00
pci_xhci.h
pciids_intel_gpus.h bhyve: add PCI IDs of Intel GPUs from Linux v6.15 2025-06-24 08:13:29 +02:00
pctestdev.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
pctestdev.h
qemu_fwcfg.c
qemu_fwcfg.h
qemu_loader.c
qemu_loader.h
rfb.c bhyve: add UNIX domain socket support to rfb 2026-01-08 15:24:52 +00:00
rfb.h bhyve: add UNIX domain socket support to rfb 2026-01-08 15:24:52 +00:00
rtc_pl031.c bhyve: Implement a PL031 RTC on arm64 2024-04-10 11:17:56 -04:00
rtc_pl031.h bhyve: Implement a PL031 RTC on arm64 2024-04-10 11:17:56 -04:00
smbiostbl.c bhyve: Use vm_get_highmem_base() instead of hard-coding the value 2024-04-10 11:17:55 -04:00
smbiostbl.h
snapshot.c bhyve: Eliminate exit status magic numbers 2025-12-17 15:08:32 +01:00
snapshot.h
sockstream.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
sockstream.h
tpm_device.c
tpm_device.h
tpm_emul.h
tpm_emul_passthru.c
tpm_emul_swtpm.c bhyve: TPM 2.0 emulation with swtpm 2024-10-22 14:04:24 +02:00
tpm_intf.h
tpm_intf_crb.c bhyve: TPM CRB: pass actual TPM request length to backend execute_cmd() 2024-10-22 14:04:23 +02:00
tpm_ppi.h
tpm_ppi_qemu.c bhyve/tpm_ppi_qemu: Cast address of the TPP3 field to uint32_t 2025-07-27 18:31:49 +02:00
uart_backend.c bhyve uart: Fix errors from GCC 2024-10-02 17:31:59 -04:00
uart_backend.h bhyve: Move lock of uart frontend to uart backend 2024-05-01 11:09:31 -04:00
uart_emul.c bhyve: Move lock of uart frontend to uart backend 2024-05-01 11:09:31 -04:00
uart_emul.h bhyve: Add PL011 UART emulation 2024-04-10 11:17:55 -04:00
uart_pl011.c bhyve: Move lock of uart frontend to uart backend 2024-05-01 11:09:31 -04:00
usb_emul.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
usb_emul.h bhyve: Populate the device version from the backend 2025-08-09 23:15:41 -04:00
usb_mouse.c Fix NULL deref segfault in bhyve's usb_mouse.c 2026-01-09 13:17:13 -07:00
virtio.c bhyve: avoid TOCTOU on iov_len in virtio_vq_recordon() 2024-09-27 10:20:53 -04:00
virtio.h usr.sbin: Remove repeated words 2024-04-11 11:53:37 -06:00
vmexit.h
vmgenc.c usr.sbin: Automated cleanup of cdefs and other formatting 2023-11-26 22:24:01 -07:00
vmgenc.h