svn commit: r308642 - head/sys/kern
Konstantin Belousov
kib at FreeBSD.org
Mon Nov 14 13:20:11 UTC 2016
Author: kib
Date: Mon Nov 14 13:20:10 2016
New Revision: 308642
URL: https://svnweb.freebsd.org/changeset/base/308642
Log:
Initialize reserved bytes in struct mq_attr and its 32compat
counterpart, to avoid kernel stack content leak in kmq_setattr(2)
syscall. Also slightly simplify the checks around copyout()s.
Reported by: Vlad Tsyrklevich <vlad902+spam at gmail.com>
PR: 214488
MFC after: 1 week
Modified:
head/sys/kern/uipc_mqueue.c
Modified: head/sys/kern/uipc_mqueue.c
==============================================================================
--- head/sys/kern/uipc_mqueue.c Mon Nov 14 12:56:18 2016 (r308641)
+++ head/sys/kern/uipc_mqueue.c Mon Nov 14 13:20:10 2016 (r308642)
@@ -2242,10 +2242,10 @@ sys_kmq_setattr(struct thread *td, struc
}
error = kern_kmq_setattr(td, uap->mqd, uap->attr != NULL ? &attr : NULL,
&oattr);
- if (error != 0)
- return (error);
- if (uap->oattr != NULL)
+ if (error == 0 && uap->oattr != NULL) {
+ bzero(oattr.__reserved, sizeof(oattr.__reserved));
error = copyout(&oattr, uap->oattr, sizeof(oattr));
+ }
return (error);
}
@@ -2759,10 +2759,9 @@ freebsd32_kmq_setattr(struct thread *td,
}
error = kern_kmq_setattr(td, uap->mqd, uap->attr != NULL ? &attr : NULL,
&oattr);
- if (error != 0)
- return (error);
- if (uap->oattr != NULL) {
+ if (error == 0 && uap->oattr != NULL) {
mq_attr_to32(&oattr, &oattr32);
+ bzero(oattr32.__reserved, sizeof(oattr32.__reserved));
error = copyout(&oattr32, uap->oattr, sizeof(oattr32));
}
return (error);
More information about the svn-src-all
mailing list