d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix several leaks of kernel stack data through paddings.

Browse Source 
It is random collection of fixes for issues not yet corrected,
reported at https://tsyrklevi.ch/clang_analyzer/freebsd_013017/. Many
issues from that list were already corrected. Most of them are for
compat32, old compat32 or affect both primary host ABI and compat32.

The freebsd32_kldstat(), for instance, was already fixed by using
malloc(M_ZERO).  Patch includes correction to report the supplied
version back, which is just pedantic.

Reviewed by:	brooks, emaste (previous version)
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D14868
This commit is contained in:
Konstantin Belousov 2018-03-27 18:05:51 +00:00
parent 2f1f9ccea7
commit fb441a8829
5 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sys/compat/freebsd32/freebsd32_misc.c
View File

@ -3285,6 +3285,7 @@ freebsd32_kldstat(struct thread *td, struct freebsd32_kldstat_args *uap)
CP(*stat, *stat32, size); CP(*stat, *stat32, size);
bcopy(&stat->pathname[0], &stat32->pathname[0], bcopy(&stat->pathname[0], &stat32->pathname[0],
sizeof(stat->pathname)); sizeof(stat->pathname));
stat32->version = version;
error = copyout(stat32, uap->stat, version); error = copyout(stat32, uap->stat, version);
} }
free(stat, M_TEMP); free(stat, M_TEMP);

3
sys/dev/pci/pci_user.c
View File

@ -770,6 +770,8 @@ pci_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *t
#ifdef PRE7_COMPAT #ifdef PRE7_COMPAT
#ifdef COMPAT_FREEBSD32 #ifdef COMPAT_FREEBSD32
if (cmd == PCIOCGETCONF_OLD32) { if (cmd == PCIOCGETCONF_OLD32) {
memset(&conf_old32, 0,
sizeof(conf_old32));
conf_old32.pc_sel.pc_bus = conf_old32.pc_sel.pc_bus =
dinfo->conf.pc_sel.pc_bus; dinfo->conf.pc_sel.pc_bus;
conf_old32.pc_sel.pc_dev = conf_old32.pc_sel.pc_dev =
@ -803,6 +805,7 @@ pci_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *t
} else } else
#endif /* COMPAT_FREEBSD32 */ #endif /* COMPAT_FREEBSD32 */
if (cmd == PCIOCGETCONF_OLD) { if (cmd == PCIOCGETCONF_OLD) {
memset(&conf_old, 0, sizeof(conf_old));
conf_old.pc_sel.pc_bus = conf_old.pc_sel.pc_bus =
dinfo->conf.pc_sel.pc_bus; dinfo->conf.pc_sel.pc_bus;
conf_old.pc_sel.pc_dev = conf_old.pc_sel.pc_dev =

2
sys/kern/kern_ntptime.c
View File

@ -285,6 +285,8 @@ sys_ntp_gettime(struct thread *td, struct ntp_gettime_args *uap)
{ {
struct ntptimeval ntv; struct ntptimeval ntv;
memset(&ntv, 0, sizeof(ntv));
NTP_LOCK(); NTP_LOCK();
ntp_gettime1(&ntv); ntp_gettime1(&ntv);
NTP_UNLOCK(); NTP_UNLOCK();

2
sys/kern/kern_sig.c
View File

@ -694,8 +694,8 @@ kern_sigaction(struct thread *td, int sig, const struct sigaction *act,
ps = p->p_sigacts; ps = p->p_sigacts;
mtx_lock(&ps->ps_mtx); mtx_lock(&ps->ps_mtx);
if (oact) { if (oact) {
memset(oact, 0, sizeof(*oact));
oact->sa_mask = ps->ps_catchmask[_SIG_IDX(sig)]; oact->sa_mask = ps->ps_catchmask[_SIG_IDX(sig)];
oact->sa_flags = 0;
if (SIGISMEMBER(ps->ps_sigonstack, sig)) if (SIGISMEMBER(ps->ps_sigonstack, sig))
oact->sa_flags |= SA_ONSTACK; oact->sa_flags |= SA_ONSTACK;
if (!SIGISMEMBER(ps->ps_sigintr, sig)) if (!SIGISMEMBER(ps->ps_sigintr, sig))

2
sys/kern/sysv_shm.c
View File

@ -1471,6 +1471,7 @@ freebsd7_freebsd32_shmctl(struct thread *td,
break; break;
case SHM_STAT: case SHM_STAT:
case IPC_STAT: case IPC_STAT:
memset(&u32.shmid_ds32, 0, sizeof(u32.shmid_ds32));
freebsd32_ipcperm_old_out(&u.shmid_ds.shm_perm, freebsd32_ipcperm_old_out(&u.shmid_ds.shm_perm,
&u32.shmid_ds32.shm_perm); &u32.shmid_ds32.shm_perm);
if (u.shmid_ds.shm_segsz > INT32_MAX) if (u.shmid_ds.shm_segsz > INT32_MAX)
@ -1634,6 +1635,7 @@ freebsd7_shmctl(struct thread *td, struct freebsd7_shmctl_args *uap)
/* Cases in which we need to copyout */ /* Cases in which we need to copyout */
switch (uap->cmd) { switch (uap->cmd) {
case IPC_STAT: case IPC_STAT:
memset(&old, 0, sizeof(old));
ipcperm_new2old(&buf.shm_perm, &old.shm_perm); ipcperm_new2old(&buf.shm_perm, &old.shm_perm);
if (buf.shm_segsz > INT_MAX) if (buf.shm_segsz > INT_MAX)
old.shm_segsz = INT_MAX; old.shm_segsz = INT_MAX;