Fix several leaks of kernel stack data through paddings.
It is random collection of fixes for issues not yet corrected, reported at https://tsyrklevi.ch/clang_analyzer/freebsd_013017/. Many issues from that list were already corrected. Most of them are for compat32, old compat32 or affect both primary host ABI and compat32. The freebsd32_kldstat(), for instance, was already fixed by using malloc(M_ZERO). Patch includes correction to report the supplied version back, which is just pedantic. Reviewed by: brooks, emaste (previous version) Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D14868
This commit is contained in:
parent
2f1f9ccea7
commit
fb441a8829
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=331640
@ -3285,6 +3285,7 @@ freebsd32_kldstat(struct thread *td, struct freebsd32_kldstat_args *uap)
|
||||
CP(*stat, *stat32, size);
|
||||
bcopy(&stat->pathname[0], &stat32->pathname[0],
|
||||
sizeof(stat->pathname));
|
||||
stat32->version = version;
|
||||
error = copyout(stat32, uap->stat, version);
|
||||
}
|
||||
free(stat, M_TEMP);
|
||||
|
@ -770,6 +770,8 @@ pci_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *t
|
||||
#ifdef PRE7_COMPAT
|
||||
#ifdef COMPAT_FREEBSD32
|
||||
if (cmd == PCIOCGETCONF_OLD32) {
|
||||
memset(&conf_old32, 0,
|
||||
sizeof(conf_old32));
|
||||
conf_old32.pc_sel.pc_bus =
|
||||
dinfo->conf.pc_sel.pc_bus;
|
||||
conf_old32.pc_sel.pc_dev =
|
||||
@ -803,6 +805,7 @@ pci_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *t
|
||||
} else
|
||||
#endif /* COMPAT_FREEBSD32 */
|
||||
if (cmd == PCIOCGETCONF_OLD) {
|
||||
memset(&conf_old, 0, sizeof(conf_old));
|
||||
conf_old.pc_sel.pc_bus =
|
||||
dinfo->conf.pc_sel.pc_bus;
|
||||
conf_old.pc_sel.pc_dev =
|
||||
|
@ -285,6 +285,8 @@ sys_ntp_gettime(struct thread *td, struct ntp_gettime_args *uap)
|
||||
{
|
||||
struct ntptimeval ntv;
|
||||
|
||||
memset(&ntv, 0, sizeof(ntv));
|
||||
|
||||
NTP_LOCK();
|
||||
ntp_gettime1(&ntv);
|
||||
NTP_UNLOCK();
|
||||
|
@ -694,8 +694,8 @@ kern_sigaction(struct thread *td, int sig, const struct sigaction *act,
|
||||
ps = p->p_sigacts;
|
||||
mtx_lock(&ps->ps_mtx);
|
||||
if (oact) {
|
||||
memset(oact, 0, sizeof(*oact));
|
||||
oact->sa_mask = ps->ps_catchmask[_SIG_IDX(sig)];
|
||||
oact->sa_flags = 0;
|
||||
if (SIGISMEMBER(ps->ps_sigonstack, sig))
|
||||
oact->sa_flags |= SA_ONSTACK;
|
||||
if (!SIGISMEMBER(ps->ps_sigintr, sig))
|
||||
|
@ -1471,6 +1471,7 @@ freebsd7_freebsd32_shmctl(struct thread *td,
|
||||
break;
|
||||
case SHM_STAT:
|
||||
case IPC_STAT:
|
||||
memset(&u32.shmid_ds32, 0, sizeof(u32.shmid_ds32));
|
||||
freebsd32_ipcperm_old_out(&u.shmid_ds.shm_perm,
|
||||
&u32.shmid_ds32.shm_perm);
|
||||
if (u.shmid_ds.shm_segsz > INT32_MAX)
|
||||
@ -1634,6 +1635,7 @@ freebsd7_shmctl(struct thread *td, struct freebsd7_shmctl_args *uap)
|
||||
/* Cases in which we need to copyout */
|
||||
switch (uap->cmd) {
|
||||
case IPC_STAT:
|
||||
memset(&old, 0, sizeof(old));
|
||||
ipcperm_new2old(&buf.shm_perm, &old.shm_perm);
|
||||
if (buf.shm_segsz > INT_MAX)
|
||||
old.shm_segsz = INT_MAX;
|
||||
|
Loading…
Reference in New Issue
Block a user