From 2b57cc5494b9795953014d1f6a2f250a9edc8287 Mon Sep 17 00:00:00 2001
From: gordon <gordon@FreeBSD.org>
Date: Wed, 12 Sep 2018 05:07:35 +0000
Subject: [PATCH] Fix improper elf header parsing. [SA-18:12.elf]

Approved by:	so
Security:	FreeBSD-SA-18:12.elf
Security:	CVE-2018-6924
---
 UPDATING              | 7 +++++++
 sys/conf/newvers.sh   | 2 +-
 sys/kern/imgact_elf.c | 8 +++++++-
 sys/kern/vfs_vnops.c  | 2 ++
 4 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/UPDATING b/UPDATING
index 2fc2f4b5026..1fcb5f11d57 100644
--- a/UPDATING
+++ b/UPDATING
@@ -16,6 +16,13 @@ from older versions of FreeBSD, try WITHOUT_CLANG and WITH_GCC to bootstrap to
 the tip of head, and then rebuild without this option. The bootstrap process
 from older version of current across the gcc/clang cutover is a bit fragile.
 
+20180912	p3	FreeBSD-SA-18:12.elf
+			FreeBSD-EN-18:08.lazyfpu
+
+	Fix improper elf header parsing. [SA-18:12.elf]
+
+	Fix regression in Lazy FPU remediation. [EN-18:08.lazyfpu]
+
 20180814	p2	FreeBSD-SA-18:08.tcp [revised]
 			FreeBSD-SA-18:09.l1tf
 			FreeBSD-SA-18:10.ip
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 9639642c13f..d2053e4725b 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -44,7 +44,7 @@
 
 TYPE="FreeBSD"
 REVISION="11.2"
-BRANCH="RELEASE-p2"
+BRANCH="RELEASE-p3"
 if [ -n "${BRANCH_OVERRIDE}" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi
diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c
index 3c3da646d79..0c3bb6f57af 100644
--- a/sys/kern/imgact_elf.c
+++ b/sys/kern/imgact_elf.c
@@ -839,7 +839,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp)
 			break;
 		case PT_INTERP:
 			/* Path to interpreter */
-			if (phdr[i].p_filesz > MAXPATHLEN) {
+			if (phdr[i].p_filesz < 2 ||
+			    phdr[i].p_filesz > MAXPATHLEN) {
 				uprintf("Invalid PT_INTERP\n");
 				error = ENOEXEC;
 				goto ret;
@@ -869,6 +870,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp)
 			} else {
 				interp = __DECONST(char *, imgp->image_header) +
 				    phdr[i].p_offset;
+				if (interp[interp_name_len - 1] != '\0') {
+					uprintf("Invalid PT_INTERP\n");
+					error = ENOEXEC;
+					goto ret;
+				}
 			}
 			break;
 		case PT_GNU_STACK:
diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
index e0fae5e5429..0e1c7fc4752 100644
--- a/sys/kern/vfs_vnops.c
+++ b/sys/kern/vfs_vnops.c
@@ -528,6 +528,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, int len, off_t offset,
 	struct vn_io_fault_args args;
 	int error, lock_flags;
 
+	if (offset < 0 && vp->v_type != VCHR)
+		return (EINVAL);
 	auio.uio_iov = &aiov;
 	auio.uio_iovcnt = 1;
 	aiov.iov_base = base;
-- 
2.45.0