diff options
| author | martin <martin@NetBSD.org> | 2020-01-02 09:50:34 +0000 |
|---|---|---|
| committer | martin <martin@NetBSD.org> | 2020-01-02 09:50:34 +0000 |
| commit | 154b101ef0021eff47fca2c4b56bab71dc00a486 (patch) | |
| tree | 7e4d27ea89c57f1edc5f1f27dd5033b1e1d24028 /sys/compat/common | |
| parent | 0b8b9a474055bb5eb220ceb02ed0ba987139bb46 (diff) | |
Pull up following revision(s) (requested by maxv in ticket #597):
sys/compat/common/kern_sig_43.c: revision 1.36
sys/compat/netbsd32/netbsd32_compat_20.c: revision 1.39
sys/compat/netbsd32/netbsd32_compat_43.c: revision 1.59
sys/compat/netbsd32/netbsd32_compat_50.c: revision 1.44
Fix sizeof mismatch in copyin. This leads to a user-triggerable stack
overflow. On my test build at least, by luck, the compiler orders the
variables in a way that the overflow hits only local structures which
haven't yet been initialized and used, so the overflow is harmless.
Very easily seeable with kASan - just invoke the syscall from a 32bit
binary.
Fix three stack info leaks, found by kMSan when just invoking all syscalls
with a zero page as argument.
MSan: Uninitialized Stack Memory In copyout() At Offset 0, Variable 'sb32' From compat_20_netbsd32_getfsstat()
MSan: Uninitialized Stack Memory In copyout() At Offset 12, Variable 'oss' From compat_43_sys_sigstack()
MSan: Uninitialized Stack Memory In copyout() At Offset 0, Variable 'sb' From compat_50_netbsd32___fhstat40()
Diffstat (limited to 'sys/compat/common')
| -rw-r--r-- | sys/compat/common/kern_sig_43.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/compat/common/kern_sig_43.c b/sys/compat/common/kern_sig_43.c index 32893244821..384e92e26f9 100644 --- a/sys/compat/common/kern_sig_43.c +++ b/sys/compat/common/kern_sig_43.c @@ -1,4 +1,4 @@ -/* $NetBSD: kern_sig_43.c,v 1.35 2019/01/27 02:08:39 pgoyette Exp $ */ +/* $NetBSD: kern_sig_43.c,v 1.35.4.1 2020/01/02 09:50:34 martin Exp $ */ /*- * Copyright (c) 1998 The NetBSD Foundation, Inc. @@ -30,7 +30,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: kern_sig_43.c,v 1.35 2019/01/27 02:08:39 pgoyette Exp $"); +__KERNEL_RCSID(0, "$NetBSD: kern_sig_43.c,v 1.35.4.1 2020/01/02 09:50:34 martin Exp $"); #if defined(_KERNEL_OPT) #include "opt_compat_netbsd.h" @@ -128,6 +128,7 @@ compat_43_sigstack_to_sigaltstack(const struct sigstack *ss, struct sigaltstack void compat_43_sigaltstack_to_sigstack(const struct sigaltstack *sa, struct sigstack *ss) { + memset(ss, 0, sizeof(*ss)); ss->ss_sp = sa->ss_sp; if (sa->ss_flags & SS_ONSTACK) ss->ss_onstack = 1; |
