o Fix OpenSSH xauth(1) command injection. [SA-16:14]

o Fix incorrect argument validation in sysarch(2). [SA-16:15]
o Fix Hyper-V KVP (Key-Value Pair) daemon indefinite sleep. [EN-16:04]

Errata:         FreeBSD-EN-16:04.hyperv
Security:       FreeBSD-SA-16:14.openssh-xauth, CVE-2016-3115
Security:       FreeBSD-SA-16:15.sysarch, CVE-2016-1885
Approved by:    so

1 files changed, 10 insertions, 1 deletions

diff --git a/sys/dev/hyperv/utilities/hv_kvp.c b/sys/dev/hyperv/utilities/hv_kvp.c
index 848d364..50ef971 100644
--- a/sys/dev/hyperv/utilities/hv_kvp.c
+++ b/sys/dev/hyperv/utilities/hv_kvp.c
@@ -44,6 +44,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/reboot.h>
 #include <sys/lock.h>
 #include <sys/taskqueue.h>
+#include <sys/selinfo.h>
 #include <sys/sysctl.h>
 #include <sys/poll.h>
 #include <sys/proc.h>
@@ -113,6 +114,8 @@ static struct cdev *hv_kvp_dev;
 static struct hv_kvp_msg *hv_kvp_dev_buf;
 struct proc *daemon_task;
 
+static struct selinfo hv_kvp_selinfo;
+
 /*
  * Global state to track and synchronize multiple
  * KVP transaction requests from the host.
@@ -627,6 +630,9 @@ hv_kvp_send_msg_to_daemon(void)
 
 	/* Send the msg to user via function deamon_read - setting sema */
 	sema_post(&kvp_globals.dev_sema);
+
+	/* We should wake up the daemon, in case it's doing poll() */
+	selwakeup(&hv_kvp_selinfo);
 }
 
 
@@ -939,7 +945,7 @@ hv_kvp_dev_daemon_write(struct cdev *dev __unused, struct uio *uio, int ioflag _
  * for daemon to read.
  */
 static int
-hv_kvp_dev_daemon_poll(struct cdev *dev __unused, int events, struct thread *td  __unused)
+hv_kvp_dev_daemon_poll(struct cdev *dev __unused, int events, struct thread *td)
 {
 	int revents = 0;
 
@@ -952,6 +958,9 @@ hv_kvp_dev_daemon_poll(struct cdev *dev __unused, int events, struct thread *td
 	 */
 	if (kvp_globals.daemon_busy == true)
 		revents = POLLIN;
+	else
+		selrecord(td, &hv_kvp_selinfo);
+
 	mtx_unlock(&kvp_globals.pending_mutex);
 
 	return (revents);