Initialize reserved bytes in struct mq_attr and its 32compat

counterpart, to avoid kernel stack content leak in kmq_setattr(2)
syscall.  Also slightly simplify the checks around copyout()s.

Reported by:	Vlad Tsyrklevich <vlad902+spam@gmail.com>
PR:	214488
MFC after:	1 week
This commit is contained in:
Konstantin Belousov
2016-11-14 13:20:10 +00:00
parent 876fe7b1bd
commit ae44bb0146
+5 -6
View File
@@ -2242,10 +2242,10 @@ sys_kmq_setattr(struct thread *td, struct kmq_setattr_args *uap)
}
error = kern_kmq_setattr(td, uap->mqd, uap->attr != NULL ? &attr : NULL,
&oattr);
if (error != 0)
return (error);
if (uap->oattr != NULL)
if (error == 0 && uap->oattr != NULL) {
bzero(oattr.__reserved, sizeof(oattr.__reserved));
error = copyout(&oattr, uap->oattr, sizeof(oattr));
}
return (error);
}
@@ -2759,10 +2759,9 @@ freebsd32_kmq_setattr(struct thread *td, struct freebsd32_kmq_setattr_args *uap)
}
error = kern_kmq_setattr(td, uap->mqd, uap->attr != NULL ? &attr : NULL,
&oattr);
if (error != 0)
return (error);
if (uap->oattr != NULL) {
if (error == 0 && uap->oattr != NULL) {
mq_attr_to32(&oattr, &oattr32);
bzero(oattr32.__reserved, sizeof(oattr32.__reserved));
error = copyout(&oattr32, uap->oattr, sizeof(oattr32));
}
return (error);