Skip site navigation (1)Skip section navigation (2) 
Date:      Tue, 2 Jan 2018 18:31:33 +0000 (UTC)
From:      Ed Maste <emaste@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r327498 - in head/sys/dev: hptnr hptrr
Message-ID:  <201801021831.w02IVXYM095289@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: emaste
Date: Tue Jan  2 18:31:32 2018
New Revision: 327498
URL: https://svnweb.freebsd.org/changeset/base/327498

Log:
  hpt{nr,rr}: plug info leak in hpt_ioctl
  
  The hpt{nr,rr} ioctl handler allocates a buffer without M_ZERO and calls
  hpt_do_ioctl(), which might not overwrite the entire buffer.
  
  Also zero bytesReturned in case it is not written by hpt_do_ioctl().
  
  The hpt27{nr,rr} device has permissions only for root so this is not urgent,
  and the fix can be MFCd and considered for a future EN.
  
  The same issue was reported in the hpt27xx driver by Ilja Van Sprundel.
  
  Reviewed by:	jhb, kib
  MFC after:	3 days
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sys/dev/hptnr/hptnr_osm_bsd.c
  head/sys/dev/hptrr/hptrr_osm_bsd.c

Modified: head/sys/dev/hptnr/hptnr_osm_bsd.c
==============================================================================
--- head/sys/dev/hptnr/hptnr_osm_bsd.c	Tue Jan  2 18:29:44 2018	(r327497)
+++ head/sys/dev/hptnr/hptnr_osm_bsd.c	Tue Jan  2 18:31:32 2018	(r327498)
@@ -1586,7 +1586,7 @@ static int hpt_ioctl(struct cdev *dev, u_long cmd, cad
 {
 	PHPT_IOCTL_PARAM piop=(PHPT_IOCTL_PARAM)data;
 	IOCTL_ARG ioctl_args;
-	HPT_U32 bytesReturned;
+	HPT_U32 bytesReturned = 0;
 
 	switch (cmd){
 	case HPT_DO_IOCONTROL:
@@ -1616,7 +1616,7 @@ static int hpt_ioctl(struct cdev *dev, u_long cmd, cad
 		}
 	
 		if (ioctl_args.nOutBufferSize) {
-			ioctl_args.lpOutBuffer = malloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK);
+			ioctl_args.lpOutBuffer = malloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK | M_ZERO);
 			if (!ioctl_args.lpOutBuffer)
 				goto invalid;
 		}

Modified: head/sys/dev/hptrr/hptrr_osm_bsd.c
==============================================================================
--- head/sys/dev/hptrr/hptrr_osm_bsd.c	Tue Jan  2 18:29:44 2018	(r327497)
+++ head/sys/dev/hptrr/hptrr_osm_bsd.c	Tue Jan  2 18:31:32 2018	(r327498)
@@ -1233,7 +1233,7 @@ static int hpt_ioctl(struct cdev *dev, u_long cmd, cad
 {
 	PHPT_IOCTL_PARAM piop=(PHPT_IOCTL_PARAM)data;
 	IOCTL_ARG ioctl_args;
-	HPT_U32 bytesReturned;
+	HPT_U32 bytesReturned = 0;
 
 	switch (cmd){
 	case HPT_DO_IOCONTROL:
@@ -1263,7 +1263,7 @@ static int hpt_ioctl(struct cdev *dev, u_long cmd, cad
 		}
 	
 		if (ioctl_args.nOutBufferSize) {
-			ioctl_args.lpOutBuffer = malloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK);
+			ioctl_args.lpOutBuffer = malloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK | M_ZERO);
 			if (!ioctl_args.lpOutBuffer)
 				goto invalid;
 		}

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201801021831.w02IVXYM095289>