From owner-svn-src-all@freebsd.org Tue Mar 27 18:05:52 2018 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1958DF71283; Tue, 27 Mar 2018 18:05:52 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id BE9C176D6B; Tue, 27 Mar 2018 18:05:51 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B98501F8DD; Tue, 27 Mar 2018 18:05:51 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w2RI5paM080654; Tue, 27 Mar 2018 18:05:51 GMT (envelope-from kib@FreeBSD.org) Received: (from kib@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w2RI5pi6080649; Tue, 27 Mar 2018 18:05:51 GMT (envelope-from kib@FreeBSD.org) Message-Id: <201803271805.w2RI5pi6080649@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kib set sender to kib@FreeBSD.org using -f From: Konstantin Belousov Date: Tue, 27 Mar 2018 18:05:51 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r331640 - in head/sys: compat/freebsd32 dev/pci kern X-SVN-Group: head X-SVN-Commit-Author: kib X-SVN-Commit-Paths: in head/sys: compat/freebsd32 dev/pci kern X-SVN-Commit-Revision: 331640 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Mar 2018 18:05:52 -0000 Author: kib Date: Tue Mar 27 18:05:51 2018 New Revision: 331640 URL: https://svnweb.freebsd.org/changeset/base/331640 Log: Fix several leaks of kernel stack data through paddings. It is random collection of fixes for issues not yet corrected, reported at https://tsyrklevi.ch/clang_analyzer/freebsd_013017/. Many issues from that list were already corrected. Most of them are for compat32, old compat32 or affect both primary host ABI and compat32. The freebsd32_kldstat(), for instance, was already fixed by using malloc(M_ZERO). Patch includes correction to report the supplied version back, which is just pedantic. Reviewed by: brooks, emaste (previous version) Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D14868 Modified: head/sys/compat/freebsd32/freebsd32_misc.c head/sys/dev/pci/pci_user.c head/sys/kern/kern_ntptime.c head/sys/kern/kern_sig.c head/sys/kern/sysv_shm.c Modified: head/sys/compat/freebsd32/freebsd32_misc.c ============================================================================== --- head/sys/compat/freebsd32/freebsd32_misc.c Tue Mar 27 17:58:00 2018 (r331639) +++ head/sys/compat/freebsd32/freebsd32_misc.c Tue Mar 27 18:05:51 2018 (r331640) @@ -3285,6 +3285,7 @@ freebsd32_kldstat(struct thread *td, struct freebsd32_ CP(*stat, *stat32, size); bcopy(&stat->pathname[0], &stat32->pathname[0], sizeof(stat->pathname)); + stat32->version = version; error = copyout(stat32, uap->stat, version); } free(stat, M_TEMP); Modified: head/sys/dev/pci/pci_user.c ============================================================================== --- head/sys/dev/pci/pci_user.c Tue Mar 27 17:58:00 2018 (r331639) +++ head/sys/dev/pci/pci_user.c Tue Mar 27 18:05:51 2018 (r331640) @@ -770,6 +770,8 @@ pci_ioctl(struct cdev *dev, u_long cmd, caddr_t data, #ifdef PRE7_COMPAT #ifdef COMPAT_FREEBSD32 if (cmd == PCIOCGETCONF_OLD32) { + memset(&conf_old32, 0, + sizeof(conf_old32)); conf_old32.pc_sel.pc_bus = dinfo->conf.pc_sel.pc_bus; conf_old32.pc_sel.pc_dev = @@ -803,6 +805,7 @@ pci_ioctl(struct cdev *dev, u_long cmd, caddr_t data, } else #endif /* COMPAT_FREEBSD32 */ if (cmd == PCIOCGETCONF_OLD) { + memset(&conf_old, 0, sizeof(conf_old)); conf_old.pc_sel.pc_bus = dinfo->conf.pc_sel.pc_bus; conf_old.pc_sel.pc_dev = Modified: head/sys/kern/kern_ntptime.c ============================================================================== --- head/sys/kern/kern_ntptime.c Tue Mar 27 17:58:00 2018 (r331639) +++ head/sys/kern/kern_ntptime.c Tue Mar 27 18:05:51 2018 (r331640) @@ -285,6 +285,8 @@ sys_ntp_gettime(struct thread *td, struct ntp_gettime_ { struct ntptimeval ntv; + memset(&ntv, 0, sizeof(ntv)); + NTP_LOCK(); ntp_gettime1(&ntv); NTP_UNLOCK(); Modified: head/sys/kern/kern_sig.c ============================================================================== --- head/sys/kern/kern_sig.c Tue Mar 27 17:58:00 2018 (r331639) +++ head/sys/kern/kern_sig.c Tue Mar 27 18:05:51 2018 (r331640) @@ -694,8 +694,8 @@ kern_sigaction(struct thread *td, int sig, const struc ps = p->p_sigacts; mtx_lock(&ps->ps_mtx); if (oact) { + memset(oact, 0, sizeof(*oact)); oact->sa_mask = ps->ps_catchmask[_SIG_IDX(sig)]; - oact->sa_flags = 0; if (SIGISMEMBER(ps->ps_sigonstack, sig)) oact->sa_flags |= SA_ONSTACK; if (!SIGISMEMBER(ps->ps_sigintr, sig)) Modified: head/sys/kern/sysv_shm.c ============================================================================== --- head/sys/kern/sysv_shm.c Tue Mar 27 17:58:00 2018 (r331639) +++ head/sys/kern/sysv_shm.c Tue Mar 27 18:05:51 2018 (r331640) @@ -1471,6 +1471,7 @@ freebsd7_freebsd32_shmctl(struct thread *td, break; case SHM_STAT: case IPC_STAT: + memset(&u32.shmid_ds32, 0, sizeof(u32.shmid_ds32)); freebsd32_ipcperm_old_out(&u.shmid_ds.shm_perm, &u32.shmid_ds32.shm_perm); if (u.shmid_ds.shm_segsz > INT32_MAX) @@ -1634,6 +1635,7 @@ freebsd7_shmctl(struct thread *td, struct freebsd7_shm /* Cases in which we need to copyout */ switch (uap->cmd) { case IPC_STAT: + memset(&old, 0, sizeof(old)); ipcperm_new2old(&buf.shm_perm, &old.shm_perm); if (buf.shm_segsz > INT_MAX) old.shm_segsz = INT_MAX;