svn commit: r358792 - stable/11/sys/netpfil/pf

[Ed Maste]

Author: emaste
Date: Sun Mar  8 23:21:04 2020
New Revision: 358792
URL: https://svnweb.freebsd.org/changeset/base/358792

Log:
  MFC r350294: pf: zero output buffer in pfioctl
  
  Avoid potential structure padding leak.
  
  Reported by:	Vlad Tsyrklevich <vlad at tsyrklevich.net>
  Security:	Potential kernel memory disclosure
  Sponsored by:	The FreeBSD Foundation

Modified:
  stable/11/sys/netpfil/pf/pf_ioctl.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- stable/11/sys/netpfil/pf/pf_ioctl.c	Sun Mar  8 23:20:24 2020	(r358791)
+++ stable/11/sys/netpfil/pf/pf_ioctl.c	Sun Mar  8 23:21:04 2020	(r358792)
@@ -1765,7 +1765,7 @@ relock_DIOCKILLSTATES:
 			break;
 		}
 
-		p = pstore = malloc(ps->ps_len, M_TEMP, M_WAITOK);
+		p = pstore = malloc(ps->ps_len, M_TEMP, M_WAITOK | M_ZERO);
 		nr = 0;
 
 		for (i = 0; i <= pf_hashmask; i++) {