Initialize reserved bytes in struct mq_attr and its 32compat
counterpart, to avoid kernel stack content leak in kmq_setattr(2) syscall. Also slightly simplify the checks around copyout()s. Reported by: Vlad Tsyrklevich <vlad902+spam@gmail.com> PR: 214488 MFC after: 1 week
This commit is contained in:
@@ -2242,10 +2242,10 @@ sys_kmq_setattr(struct thread *td, struct kmq_setattr_args *uap)
|
||||
}
|
||||
error = kern_kmq_setattr(td, uap->mqd, uap->attr != NULL ? &attr : NULL,
|
||||
&oattr);
|
||||
if (error != 0)
|
||||
return (error);
|
||||
if (uap->oattr != NULL)
|
||||
if (error == 0 && uap->oattr != NULL) {
|
||||
bzero(oattr.__reserved, sizeof(oattr.__reserved));
|
||||
error = copyout(&oattr, uap->oattr, sizeof(oattr));
|
||||
}
|
||||
return (error);
|
||||
}
|
||||
|
||||
@@ -2759,10 +2759,9 @@ freebsd32_kmq_setattr(struct thread *td, struct freebsd32_kmq_setattr_args *uap)
|
||||
}
|
||||
error = kern_kmq_setattr(td, uap->mqd, uap->attr != NULL ? &attr : NULL,
|
||||
&oattr);
|
||||
if (error != 0)
|
||||
return (error);
|
||||
if (uap->oattr != NULL) {
|
||||
if (error == 0 && uap->oattr != NULL) {
|
||||
mq_attr_to32(&oattr, &oattr32);
|
||||
bzero(oattr32.__reserved, sizeof(oattr32.__reserved));
|
||||
error = copyout(&oattr32, uap->oattr, sizeof(oattr32));
|
||||
}
|
||||
return (error);
|
||||
|
||||
Reference in New Issue
Block a user