From d50c96bb491810004b0fd3ea08acbff05abd6140 Mon Sep 17 00:00:00 2001 From: riastradh Date: Tue, 7 Sep 2021 11:43:02 +0000 Subject: sys/compat: Memset zero before copyout. Just in case of uninitialized padding which would lead to kernel stack disclosure. If the compiler can prove the memset redundant then it can optimize it away; otherwise better safe than sorry. --- sys/compat/linux/common/linux_socket.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'sys/compat/linux/common/linux_socket.c') diff --git a/sys/compat/linux/common/linux_socket.c b/sys/compat/linux/common/linux_socket.c index b6e3c637e47..90f1c9c4edf 100644 --- a/sys/compat/linux/common/linux_socket.c +++ b/sys/compat/linux/common/linux_socket.c @@ -1,4 +1,4 @@ -/* $NetBSD: linux_socket.c,v 1.152 2020/11/03 22:08:44 christos Exp $ */ +/* $NetBSD: linux_socket.c,v 1.153 2021/09/07 11:43:04 riastradh Exp $ */ /*- * Copyright (c) 1995, 1998, 2008 The NetBSD Foundation, Inc. @@ -35,7 +35,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: linux_socket.c,v 1.152 2020/11/03 22:08:44 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: linux_socket.c,v 1.153 2021/09/07 11:43:04 riastradh Exp $"); #if defined(_KERNEL_OPT) #include "opt_inet.h" @@ -440,6 +440,7 @@ linux_sys_sendto(struct lwp *l, const struct linux_sys_sendto_args *uap, registe static void linux_to_bsd_msghdr(const struct linux_msghdr *lmsg, struct msghdr *bmsg) { + memset(bmsg, 0, sizeof(*bmsg)); bmsg->msg_name = lmsg->msg_name; bmsg->msg_namelen = lmsg->msg_namelen; bmsg->msg_iov = lmsg->msg_iov; @@ -452,6 +453,7 @@ linux_to_bsd_msghdr(const struct linux_msghdr *lmsg, struct msghdr *bmsg) static void bsd_to_linux_msghdr(const struct msghdr *bmsg, struct linux_msghdr *lmsg) { + memset(lmsg, 0, sizeof(*lmsg)); lmsg->msg_name = bmsg->msg_name; lmsg->msg_namelen = bmsg->msg_namelen; lmsg->msg_iov = bmsg->msg_iov; @@ -699,6 +701,7 @@ linux_copyout_msg_control(struct lwp *l, struct msghdr *mp, struct mbuf *control * 1. different values for level/type on some archs * 2. different alignment of CMSG_DATA on some archs */ + memset(&linux_cmsg, 0, sizeof(linux_cmsg)); linux_cmsg.cmsg_len = cmsg->cmsg_len - LINUX_CMSG_ALIGN_DELTA; linux_cmsg.cmsg_level = cmsg->cmsg_level; linux_cmsg.cmsg_type = cmsg->cmsg_type; -- cgit