Author: vangyzen
Date: Tue Mar 21 01:23:34 2017
New Revision: 315657
URL: https://svnweb.freebsd.org/changeset/base/315657
Log:
MFC r315510
nanosleep: plug a kernel memory disclosure
nanosleep() updates rmtp on EINVAL. In that case, kern_nanosleep()
has not updated rmt, so sys_nanosleep() updates the user-space rmtp
by copying garbage from its stack frame. This is not only a kernel
memory disclosure, it's also not POSIX-compliant. Fix it to update
rmtp only on EINTR.
Security: possibly
Sponsored by: Dell EMC
Modified:
stable/11/sys/compat/freebsd32/freebsd32_misc.c
stable/11/sys/compat/linux/linux_time.c
stable/11/sys/kern/kern_time.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/compat/freebsd32/freebsd32_misc.c
==============================================================================
--- stable/11/sys/compat/freebsd32/freebsd32_misc.c Mon Mar 20 23:07:34
2017 (r315656)
+++ stable/11/sys/compat/freebsd32/freebsd32_misc.c Tue Mar 21 01:23:34
2017 (r315657)
@@ -2241,7 +2241,7 @@ freebsd32_nanosleep(struct thread *td, s
!useracc((caddr_t)uap->rmtp, sizeof(rmt), VM_PROT_WRITE))
return (EFAULT);
error = kern_nanosleep(td, &rqt, &rmt);
- if (error && uap->rmtp) {
+ if (error == EINTR && uap->rmtp) {
int error2;
CP(rmt, rmt32, tv_sec);
Modified: stable/11/sys/compat/linux/linux_time.c
==============================================================================
--- stable/11/sys/compat/linux/linux_time.c Mon Mar 20 23:07:34 2017
(r315656)
+++ stable/11/sys/compat/linux/linux_time.c Tue Mar 21 01:23:34 2017
(r315657)
@@ -489,7 +489,7 @@ linux_nanosleep(struct thread *td, struc
return (error);
}
error = kern_nanosleep(td, &rqts, rmtp);
- if (args->rmtp != NULL) {
+ if (error == EINTR && args->rmtp != NULL) {
native_to_linux_timespec(&lrmts, rmtp);
error2 = copyout(&lrmts, args->rmtp, sizeof(lrmts));
if (error2 != 0) {
@@ -551,7 +551,7 @@ linux_clock_nanosleep(struct thread *td,
return (error);
}
error = kern_nanosleep(td, &rqts, rmtp);
- if (args->rmtp != NULL) {
+ if (error == EINTR && args->rmtp != NULL) {
/* XXX. Not for TIMER_ABSTIME */
native_to_linux_timespec(&lrmts, rmtp);
error2 = copyout(&lrmts, args->rmtp, sizeof(lrmts));
Modified: stable/11/sys/kern/kern_time.c
==============================================================================
--- stable/11/sys/kern/kern_time.c Mon Mar 20 23:07:34 2017
(r315656)
+++ stable/11/sys/kern/kern_time.c Tue Mar 21 01:23:34 2017
(r315657)
@@ -541,7 +541,7 @@ sys_nanosleep(struct thread *td, struct
!useracc((caddr_t)uap->rmtp, sizeof(rmt), VM_PROT_WRITE))
return (EFAULT);
error = kern_nanosleep(td, &rqt, &rmt);
- if (error && uap->rmtp) {
+ if (error == EINTR && uap->rmtp) {
int error2;
error2 = copyout(&rmt, uap->rmtp, sizeof(rmt));
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
