Author: vangyzen
Date: Tue Mar 21 01:24:56 2017
New Revision: 315658
URL: https://svnweb.freebsd.org/changeset/base/315658
Log:
MFC r315510
nanosleep: plug a kernel memory disclosure
nanosleep() updates rmtp on EINVAL. In that case, kern_nanosleep()
has not updated rmt, so sys_nanosleep() updates the user-space rmtp
by copying garbage from its stack frame. This is not only a kernel
memory disclosure, it's also not POSIX-compliant. Fix it to update
rmtp only on EINTR.
Security: possibly
Sponsored by: Dell EMC
Modified:
stable/10/sys/compat/freebsd32/freebsd32_misc.c
stable/10/sys/compat/linux/linux_time.c
stable/10/sys/kern/kern_time.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/sys/compat/freebsd32/freebsd32_misc.c
==============================================================================
--- stable/10/sys/compat/freebsd32/freebsd32_misc.c Tue Mar 21 01:23:34
2017 (r315657)
+++ stable/10/sys/compat/freebsd32/freebsd32_misc.c Tue Mar 21 01:24:56
2017 (r315658)
@@ -2367,7 +2367,7 @@ freebsd32_nanosleep(struct thread *td, s
!useracc((caddr_t)uap->rmtp, sizeof(rmt), VM_PROT_WRITE))
return (EFAULT);
error = kern_nanosleep(td, &rqt, &rmt);
- if (error && uap->rmtp) {
+ if (error == EINTR && uap->rmtp) {
int error2;
CP(rmt, rmt32, tv_sec);
Modified: stable/10/sys/compat/linux/linux_time.c
==============================================================================
--- stable/10/sys/compat/linux/linux_time.c Tue Mar 21 01:23:34 2017
(r315657)
+++ stable/10/sys/compat/linux/linux_time.c Tue Mar 21 01:24:56 2017
(r315658)
@@ -490,7 +490,7 @@ linux_nanosleep(struct thread *td, struc
return (error);
}
error = kern_nanosleep(td, &rqts, rmtp);
- if (args->rmtp != NULL) {
+ if (error == EINTR && args->rmtp != NULL) {
native_to_linux_timespec(&lrmts, rmtp);
error2 = copyout(&lrmts, args->rmtp, sizeof(lrmts));
if (error2 != 0) {
@@ -552,7 +552,7 @@ linux_clock_nanosleep(struct thread *td,
return (error);
}
error = kern_nanosleep(td, &rqts, rmtp);
- if (args->rmtp != NULL) {
+ if (error == EINTR && args->rmtp != NULL) {
/* XXX. Not for TIMER_ABSTIME */
native_to_linux_timespec(&lrmts, rmtp);
error2 = copyout(&lrmts, args->rmtp, sizeof(lrmts));
Modified: stable/10/sys/kern/kern_time.c
==============================================================================
--- stable/10/sys/kern/kern_time.c Tue Mar 21 01:23:34 2017
(r315657)
+++ stable/10/sys/kern/kern_time.c Tue Mar 21 01:24:56 2017
(r315658)
@@ -546,7 +546,7 @@ sys_nanosleep(struct thread *td, struct
!useracc((caddr_t)uap->rmtp, sizeof(rmt), VM_PROT_WRITE))
return (EFAULT);
error = kern_nanosleep(td, &rqt, &rmt);
- if (error && uap->rmtp) {
+ if (error == EINTR && uap->rmtp) {
int error2;
error2 = copyout(&rmt, uap->rmtp, sizeof(rmt));
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
