Skip site navigation (1)Skip section navigation (2) 
Date:      Tue, 21 Mar 2017 01:24:56 +0000 (UTC)
From:      Eric van Gyzen <vangyzen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r315658 - in stable/10/sys: compat/freebsd32 compat/linux kern
Message-ID:  <201703210124.v2L1OuYv028422@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: vangyzen
Date: Tue Mar 21 01:24:56 2017
New Revision: 315658
URL: https://svnweb.freebsd.org/changeset/base/315658

Log:
  MFC r315510
  
  nanosleep: plug a kernel memory disclosure
  
  nanosleep() updates rmtp on EINVAL.  In that case, kern_nanosleep()
  has not updated rmt, so sys_nanosleep() updates the user-space rmtp
  by copying garbage from its stack frame.  This is not only a kernel
  memory disclosure, it's also not POSIX-compliant.  Fix it to update
  rmtp only on EINTR.
  
  Security:	possibly
  Sponsored by:	Dell EMC

Modified:
  stable/10/sys/compat/freebsd32/freebsd32_misc.c
  stable/10/sys/compat/linux/linux_time.c
  stable/10/sys/kern/kern_time.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/compat/freebsd32/freebsd32_misc.c
==============================================================================
--- stable/10/sys/compat/freebsd32/freebsd32_misc.c	Tue Mar 21 01:23:34 2017	(r315657)
+++ stable/10/sys/compat/freebsd32/freebsd32_misc.c	Tue Mar 21 01:24:56 2017	(r315658)
@@ -2367,7 +2367,7 @@ freebsd32_nanosleep(struct thread *td, s
 	    !useracc((caddr_t)uap->rmtp, sizeof(rmt), VM_PROT_WRITE))
 		return (EFAULT);
 	error = kern_nanosleep(td, &rqt, &rmt);
-	if (error && uap->rmtp) {
+	if (error == EINTR && uap->rmtp) {
 		int error2;
 
 		CP(rmt, rmt32, tv_sec);

Modified: stable/10/sys/compat/linux/linux_time.c
==============================================================================
--- stable/10/sys/compat/linux/linux_time.c	Tue Mar 21 01:23:34 2017	(r315657)
+++ stable/10/sys/compat/linux/linux_time.c	Tue Mar 21 01:24:56 2017	(r315658)
@@ -490,7 +490,7 @@ linux_nanosleep(struct thread *td, struc
 		return (error);
 	}
 	error = kern_nanosleep(td, &rqts, rmtp);
-	if (args->rmtp != NULL) {
+	if (error == EINTR && args->rmtp != NULL) {
 		native_to_linux_timespec(&lrmts, rmtp);
 		error2 = copyout(&lrmts, args->rmtp, sizeof(lrmts));
 		if (error2 != 0) {
@@ -552,7 +552,7 @@ linux_clock_nanosleep(struct thread *td,
 		return (error);
 	}
 	error = kern_nanosleep(td, &rqts, rmtp);
-	if (args->rmtp != NULL) {
+	if (error == EINTR && args->rmtp != NULL) {
 		/* XXX. Not for TIMER_ABSTIME */
 	   	native_to_linux_timespec(&lrmts, rmtp);
 		error2 = copyout(&lrmts, args->rmtp, sizeof(lrmts));

Modified: stable/10/sys/kern/kern_time.c
==============================================================================
--- stable/10/sys/kern/kern_time.c	Tue Mar 21 01:23:34 2017	(r315657)
+++ stable/10/sys/kern/kern_time.c	Tue Mar 21 01:24:56 2017	(r315658)
@@ -546,7 +546,7 @@ sys_nanosleep(struct thread *td, struct 
 	    !useracc((caddr_t)uap->rmtp, sizeof(rmt), VM_PROT_WRITE))
 			return (EFAULT);
 	error = kern_nanosleep(td, &rqt, &rmt);
-	if (error && uap->rmtp) {
+	if (error == EINTR && uap->rmtp) {
 		int error2;
 
 		error2 = copyout(&rmt, uap->rmtp, sizeof(rmt));

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201703210124.v2L1OuYv028422>