Author: emaste
Date: Wed Jan 23 14:19:40 2019
New Revision: 343343
URL: https://svnweb.freebsd.org/changeset/base/343343
Log:
MFC linuxulator stack memory disclosure fixes
r343260 linuxulator: fix stack memory disclosure in linux_ioctl_v4l
r343261 linuxulator: fix stack memory disclosure in linux_ioctl_termio
r343262 linuxulator: fix stack memory disclosure in linux_sigaltstack
r343263 linuxulator: fix stack memory disclosure in linux_sigaltstack
admbugs: 765
Reported by: Vlad Tsyrklevich <v...@tsyrklevich.net>
Security: Kernel stack memory disclosure
Sponsored by: The FreeBSD Foundation
Modified:
stable/12/sys/amd64/linux/linux_machdep.c
stable/12/sys/compat/linux/linux_ioctl.c
stable/12/sys/compat/linux/linux_misc.c
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/sys/amd64/linux/linux_machdep.c
==============================================================================
--- stable/12/sys/amd64/linux/linux_machdep.c Wed Jan 23 13:17:03 2019
(r343342)
+++ stable/12/sys/amd64/linux/linux_machdep.c Wed Jan 23 14:19:40 2019
(r343343)
@@ -201,6 +201,7 @@ linux_sigaltstack(struct thread *td, struct linux_siga
l_stack_t lss;
int error;
+ memset(&lss, 0, sizeof(lss));
LINUX_CTR2(sigaltstack, "%p, %p", uap->uss, uap->uoss);
if (uap->uss != NULL) {
Modified: stable/12/sys/compat/linux/linux_ioctl.c
==============================================================================
--- stable/12/sys/compat/linux/linux_ioctl.c Wed Jan 23 13:17:03 2019
(r343342)
+++ stable/12/sys/compat/linux/linux_ioctl.c Wed Jan 23 14:19:40 2019
(r343343)
@@ -686,6 +686,7 @@ bsd_to_linux_termio(struct termios *bios, struct linux
{
struct linux_termios lios;
+ memset(lio, 0, sizeof(*lio));
bsd_to_linux_termios(bios, &lios);
lio->c_iflag = lios.c_iflag;
lio->c_oflag = lios.c_oflag;
@@ -2843,6 +2844,8 @@ linux_to_bsd_v4l_window(struct l_video_window *lvw, st
static int
bsd_to_linux_v4l_window(struct video_window *vw, struct l_video_window *lvw)
{
+ memset(lvw, 0, sizeof(*lvw));
+
lvw->x = vw->x;
lvw->y = vw->y;
lvw->width = vw->width;
Modified: stable/12/sys/compat/linux/linux_misc.c
==============================================================================
--- stable/12/sys/compat/linux/linux_misc.c Wed Jan 23 13:17:03 2019
(r343342)
+++ stable/12/sys/compat/linux/linux_misc.c Wed Jan 23 14:19:40 2019
(r343343)
@@ -1089,9 +1089,8 @@ linux_waitid(struct thread *td, struct linux_waitid_ar
}
if (args->info != NULL) {
p = td->td_proc;
- if (td->td_retval[0] == 0)
- bzero(&lsi, sizeof(lsi));
- else {
+ bzero(&lsi, sizeof(lsi));
+ if (td->td_retval[0] != 0) {
sig = bsd_to_linux_signal(siginfo.si_signo);
siginfo_to_lsiginfo(&siginfo, &lsi, sig);
}
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
