diff options
| author | riastradh <riastradh@NetBSD.org> | 2021-09-07 11:43:02 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2021-09-07 11:43:02 +0000 |
| commit | d50c96bb491810004b0fd3ea08acbff05abd6140 (patch) | |
| tree | e16d154152093b1cf3e149fd08f9ae1198e78a9e /sys/compat/linux/common/linux_socket.c | |
| parent | 8c28c0027cf16b13c944b0927bedb3108488033d (diff) | |
sys/compat: Memset zero before copyout.
Just in case of uninitialized padding which would lead to kernel
stack disclosure. If the compiler can prove the memset redundant
then it can optimize it away; otherwise better safe than sorry.
Diffstat (limited to 'sys/compat/linux/common/linux_socket.c')
| -rw-r--r-- | sys/compat/linux/common/linux_socket.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sys/compat/linux/common/linux_socket.c b/sys/compat/linux/common/linux_socket.c index b6e3c637e47..90f1c9c4edf 100644 --- a/sys/compat/linux/common/linux_socket.c +++ b/sys/compat/linux/common/linux_socket.c @@ -1,4 +1,4 @@ -/* $NetBSD: linux_socket.c,v 1.152 2020/11/03 22:08:44 christos Exp $ */ +/* $NetBSD: linux_socket.c,v 1.153 2021/09/07 11:43:04 riastradh Exp $ */ /*- * Copyright (c) 1995, 1998, 2008 The NetBSD Foundation, Inc. @@ -35,7 +35,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: linux_socket.c,v 1.152 2020/11/03 22:08:44 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: linux_socket.c,v 1.153 2021/09/07 11:43:04 riastradh Exp $"); #if defined(_KERNEL_OPT) #include "opt_inet.h" @@ -440,6 +440,7 @@ linux_sys_sendto(struct lwp *l, const struct linux_sys_sendto_args *uap, registe static void linux_to_bsd_msghdr(const struct linux_msghdr *lmsg, struct msghdr *bmsg) { + memset(bmsg, 0, sizeof(*bmsg)); bmsg->msg_name = lmsg->msg_name; bmsg->msg_namelen = lmsg->msg_namelen; bmsg->msg_iov = lmsg->msg_iov; @@ -452,6 +453,7 @@ linux_to_bsd_msghdr(const struct linux_msghdr *lmsg, struct msghdr *bmsg) static void bsd_to_linux_msghdr(const struct msghdr *bmsg, struct linux_msghdr *lmsg) { + memset(lmsg, 0, sizeof(*lmsg)); lmsg->msg_name = bmsg->msg_name; lmsg->msg_namelen = bmsg->msg_namelen; lmsg->msg_iov = bmsg->msg_iov; @@ -699,6 +701,7 @@ linux_copyout_msg_control(struct lwp *l, struct msghdr *mp, struct mbuf *control * 1. different values for level/type on some archs * 2. different alignment of CMSG_DATA on some archs */ + memset(&linux_cmsg, 0, sizeof(linux_cmsg)); linux_cmsg.cmsg_len = cmsg->cmsg_len - LINUX_CMSG_ALIGN_DELTA; linux_cmsg.cmsg_level = cmsg->cmsg_level; linux_cmsg.cmsg_type = cmsg->cmsg_type; |
