summaryrefslogtreecommitdiff
path: root/sys/compat/common
diff options
context:
space:
mode:
authormartin <martin@NetBSD.org>2020-01-02 09:50:34 +0000
committermartin <martin@NetBSD.org>2020-01-02 09:50:34 +0000
commit154b101ef0021eff47fca2c4b56bab71dc00a486 (patch)
tree7e4d27ea89c57f1edc5f1f27dd5033b1e1d24028 /sys/compat/common
parent0b8b9a474055bb5eb220ceb02ed0ba987139bb46 (diff)
Pull up following revision(s) (requested by maxv in ticket #597):
sys/compat/common/kern_sig_43.c: revision 1.36 sys/compat/netbsd32/netbsd32_compat_20.c: revision 1.39 sys/compat/netbsd32/netbsd32_compat_43.c: revision 1.59 sys/compat/netbsd32/netbsd32_compat_50.c: revision 1.44 Fix sizeof mismatch in copyin. This leads to a user-triggerable stack overflow. On my test build at least, by luck, the compiler orders the variables in a way that the overflow hits only local structures which haven't yet been initialized and used, so the overflow is harmless. Very easily seeable with kASan - just invoke the syscall from a 32bit binary. Fix three stack info leaks, found by kMSan when just invoking all syscalls with a zero page as argument. MSan: Uninitialized Stack Memory In copyout() At Offset 0, Variable 'sb32' From compat_20_netbsd32_getfsstat() MSan: Uninitialized Stack Memory In copyout() At Offset 12, Variable 'oss' From compat_43_sys_sigstack() MSan: Uninitialized Stack Memory In copyout() At Offset 0, Variable 'sb' From compat_50_netbsd32___fhstat40()
Diffstat (limited to 'sys/compat/common')
-rw-r--r--sys/compat/common/kern_sig_43.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/compat/common/kern_sig_43.c b/sys/compat/common/kern_sig_43.c
index 32893244821..384e92e26f9 100644
--- a/sys/compat/common/kern_sig_43.c
+++ b/sys/compat/common/kern_sig_43.c
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_sig_43.c,v 1.35 2019/01/27 02:08:39 pgoyette Exp $ */
+/* $NetBSD: kern_sig_43.c,v 1.35.4.1 2020/01/02 09:50:34 martin Exp $ */
/*-
* Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_sig_43.c,v 1.35 2019/01/27 02:08:39 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_sig_43.c,v 1.35.4.1 2020/01/02 09:50:34 martin Exp $");
#if defined(_KERNEL_OPT)
#include "opt_compat_netbsd.h"
@@ -128,6 +128,7 @@ compat_43_sigstack_to_sigaltstack(const struct sigstack *ss, struct sigaltstack
void
compat_43_sigaltstack_to_sigstack(const struct sigaltstack *sa, struct sigstack *ss)
{
+ memset(ss, 0, sizeof(*ss));
ss->ss_sp = sa->ss_sp;
if (sa->ss_flags & SS_ONSTACK)
ss->ss_onstack = 1;