Skip site navigation (1)Skip section navigation (2) 
Date:      Sat, 18 Mar 2017 20:16:23 +0000 (UTC)
From:      Eric van Gyzen <vangyzen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r315510 - in head/sys: compat/freebsd32 compat/linux kern
Message-ID:  <201703182016.v2IKGNt3016110@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: vangyzen
Date: Sat Mar 18 20:16:23 2017
New Revision: 315510
URL: https://svnweb.freebsd.org/changeset/base/315510

Log:
  nanosleep: plug a kernel memory disclosure
  
  nanosleep() updates rmtp on EINVAL.  In that case, kern_nanosleep()
  has not updated rmt, so sys_nanosleep() updates the user-space rmtp
  by copying garbage from its stack frame.  This is not only a kernel
  memory disclosure, it's also not POSIX-compliant.  Fix it to update
  rmtp only on EINTR.
  
  Reviewed by:	jilles (via D10020), dchagin
  MFC after:	3 days
  Security:	possibly
  Sponsored by:	Dell EMC
  Differential Revision:	https://reviews.freebsd.org/D10044

Modified:
  head/sys/compat/freebsd32/freebsd32_misc.c
  head/sys/compat/linux/linux_time.c
  head/sys/kern/kern_time.c

Modified: head/sys/compat/freebsd32/freebsd32_misc.c
==============================================================================
--- head/sys/compat/freebsd32/freebsd32_misc.c	Sat Mar 18 19:59:21 2017	(r315509)
+++ head/sys/compat/freebsd32/freebsd32_misc.c	Sat Mar 18 20:16:23 2017	(r315510)
@@ -2241,7 +2241,7 @@ freebsd32_nanosleep(struct thread *td, s
 	    !useracc((caddr_t)uap->rmtp, sizeof(rmt), VM_PROT_WRITE))
 		return (EFAULT);
 	error = kern_nanosleep(td, &rqt, &rmt);
-	if (error && uap->rmtp) {
+	if (error == EINTR && uap->rmtp) {
 		int error2;
 
 		CP(rmt, rmt32, tv_sec);

Modified: head/sys/compat/linux/linux_time.c
==============================================================================
--- head/sys/compat/linux/linux_time.c	Sat Mar 18 19:59:21 2017	(r315509)
+++ head/sys/compat/linux/linux_time.c	Sat Mar 18 20:16:23 2017	(r315510)
@@ -519,7 +519,7 @@ linux_nanosleep(struct thread *td, struc
 		return (error);
 	}
 	error = kern_nanosleep(td, &rqts, rmtp);
-	if (args->rmtp != NULL) {
+	if (error == EINTR && args->rmtp != NULL) {
 		error2 = native_to_linux_timespec(&lrmts, rmtp);
 		if (error2 != 0)
 			return (error2);
@@ -583,7 +583,7 @@ linux_clock_nanosleep(struct thread *td,
 		return (error);
 	}
 	error = kern_nanosleep(td, &rqts, rmtp);
-	if (args->rmtp != NULL) {
+	if (error == EINTR && args->rmtp != NULL) {
 		/* XXX. Not for TIMER_ABSTIME */
 		error2 = native_to_linux_timespec(&lrmts, rmtp);
 		if (error2 != 0)

Modified: head/sys/kern/kern_time.c
==============================================================================
--- head/sys/kern/kern_time.c	Sat Mar 18 19:59:21 2017	(r315509)
+++ head/sys/kern/kern_time.c	Sat Mar 18 20:16:23 2017	(r315510)
@@ -548,7 +548,7 @@ sys_nanosleep(struct thread *td, struct 
 	    !useracc((caddr_t)uap->rmtp, sizeof(rmt), VM_PROT_WRITE))
 			return (EFAULT);
 	error = kern_nanosleep(td, &rqt, &rmt);
-	if (error && uap->rmtp) {
+	if (error == EINTR && uap->rmtp) {
 		int error2;
 
 		error2 = copyout(&rmt, uap->rmtp, sizeof(rmt));

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201703182016.v2IKGNt3016110>