Module Name: src Committed By: mrg Date: Thu Feb 21 03:37:19 UTC 2019
Modified Files: src/sys/compat/linux/common: linux_ipc.c src/sys/compat/linux32/common: linux32_ipccall.c src/sys/compat/netbsd32: netbsd32_compat_14.c netbsd32_compat_14_sysv.c netbsd32_conv.h src/sys/compat/sys: ipc.h msg.h sem.h shm.h src/sys/kern: sysv_msg.c sysv_sem.c sysv_shm.c Log Message: for sysv ipc stat operations, explicitly copy the exported parts instead of the whole ds structure. besides triggering a recently added assert in netbsd32, this stops exposing kernel addresses. copy the mode clamping to 0777 from sem to shm and msg. while here, make sure that the compat callers to sysv_ipc clear the contents of the compat structure before setting the result members to ensure padding bytes are cleared. don't set/copy _sem_base, _msg_first, _msg_last or _shm_internal. even if used, which seems very dodgy, they leak KVAs as well. possibly this may affect linux binaries, in particular, the comments around _shm_internal ("XXX Oh well.") may mean apps rely upon these but hopefully not -- the comments date back to rev 1.1 in 1995. the _key, _seq and _msg_cbytes members are exported as before as i found multiple consumers of these (no less than ipcs(1), and they appear to be useful for debugging and more. XXX: the naming of compat functions have too many styles. there are at least 3 different ones changed here. To generate a diff of this commit: cvs rdiff -u -r1.55 -r1.56 src/sys/compat/linux/common/linux_ipc.c cvs rdiff -u -r1.11 -r1.12 src/sys/compat/linux32/common/linux32_ipccall.c cvs rdiff -u -r1.27 -r1.28 src/sys/compat/netbsd32/netbsd32_compat_14.c cvs rdiff -u -r1.2 -r1.3 src/sys/compat/netbsd32/netbsd32_compat_14_sysv.c cvs rdiff -u -r1.37 -r1.38 src/sys/compat/netbsd32/netbsd32_conv.h cvs rdiff -u -r1.5 -r1.6 src/sys/compat/sys/ipc.h src/sys/compat/sys/msg.h cvs rdiff -u -r1.6 -r1.7 src/sys/compat/sys/sem.h cvs rdiff -u -r1.7 -r1.8 src/sys/compat/sys/shm.h cvs rdiff -u -r1.72 -r1.73 src/sys/kern/sysv_msg.c cvs rdiff -u -r1.95 -r1.96 src/sys/kern/sysv_sem.c cvs rdiff -u -r1.132 -r1.133 src/sys/kern/sysv_shm.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/compat/linux/common/linux_ipc.c diff -u src/sys/compat/linux/common/linux_ipc.c:1.55 src/sys/compat/linux/common/linux_ipc.c:1.56 --- src/sys/compat/linux/common/linux_ipc.c:1.55 Sat May 28 23:24:58 2011 +++ src/sys/compat/linux/common/linux_ipc.c Thu Feb 21 03:37:18 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: linux_ipc.c,v 1.55 2011/05/28 23:24:58 alnsn Exp $ */ +/* $NetBSD: linux_ipc.c,v 1.56 2019/02/21 03:37:18 mrg Exp $ */ /*- * Copyright (c) 1995, 1998 The NetBSD Foundation, Inc. @@ -30,7 +30,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: linux_ipc.c,v 1.55 2011/05/28 23:24:58 alnsn Exp $"); +__KERNEL_RCSID(0, "$NetBSD: linux_ipc.c,v 1.56 2019/02/21 03:37:18 mrg Exp $"); #if defined(_KERNEL_OPT) #include "opt_sysv.h" @@ -117,6 +117,7 @@ void bsd_to_linux_ipc_perm(struct ipc_perm *bpp, struct linux_ipc_perm *lpp) { + memset(lpp, 0, sizeof *lpp); lpp->l_key = bpp->_key; lpp->l_uid = bpp->uid; lpp->l_gid = bpp->gid; @@ -129,6 +130,8 @@ bsd_to_linux_ipc_perm(struct ipc_perm *b void bsd_to_linux_ipc64_perm(struct ipc_perm *bpp, struct linux_ipc64_perm *lpp) { + + memset(lpp, 0, sizeof *lpp); lpp->l_key = bpp->_key; lpp->l_uid = bpp->uid; lpp->l_gid = bpp->gid; @@ -152,16 +155,19 @@ bsd_to_linux_ipc64_perm(struct ipc_perm void bsd_to_linux_semid_ds(struct semid_ds *bs, struct linux_semid_ds *ls) { + + memset(ls, 0, sizeof *ls); bsd_to_linux_ipc_perm(&bs->sem_perm, &ls->l_sem_perm); ls->l_sem_otime = bs->sem_otime; ls->l_sem_ctime = bs->sem_ctime; ls->l_sem_nsems = bs->sem_nsems; - ls->l_sem_base = bs->_sem_base; } void bsd_to_linux_semid64_ds(struct semid_ds *bs, struct linux_semid64_ds *ls) { + + memset(ls, 0, sizeof *ls); bsd_to_linux_ipc64_perm(&bs->sem_perm, &ls->l_sem_perm); ls->l_sem_otime = bs->sem_otime; ls->l_sem_ctime = bs->sem_ctime; @@ -171,16 +177,17 @@ bsd_to_linux_semid64_ds(struct semid_ds void linux_to_bsd_semid_ds(struct linux_semid_ds *ls, struct semid_ds *bs) { + linux_to_bsd_ipc_perm(&ls->l_sem_perm, &bs->sem_perm); bs->sem_otime = ls->l_sem_otime; bs->sem_ctime = ls->l_sem_ctime; bs->sem_nsems = ls->l_sem_nsems; - bs->_sem_base = ls->l_sem_base; } void linux_to_bsd_semid64_ds(struct linux_semid64_ds *ls, struct semid_ds *bs) { + linux_to_bsd_ipc64_perm(&ls->l_sem_perm, &bs->sem_perm); bs->sem_otime = ls->l_sem_otime; bs->sem_ctime = ls->l_sem_ctime; @@ -308,8 +315,6 @@ linux_to_bsd_msqid_ds(struct linux_msqid memset(bmp, 0, sizeof(*bmp)); linux_to_bsd_ipc_perm(&lmp->l_msg_perm, &bmp->msg_perm); - bmp->_msg_first = lmp->l_msg_first; - bmp->_msg_last = lmp->l_msg_last; bmp->_msg_cbytes = lmp->l_msg_cbytes; bmp->msg_qnum = lmp->l_msg_qnum; bmp->msg_qbytes = lmp->l_msg_qbytes; @@ -326,10 +331,10 @@ linux_to_bsd_msqid64_ds(struct linux_msq memset(bmp, 0, sizeof(*bmp)); linux_to_bsd_ipc64_perm(&lmp->l_msg_perm, &bmp->msg_perm); + bmp->_msg_cbytes = lmp->l_msg_cbytes; bmp->msg_stime = lmp->l_msg_stime; bmp->msg_rtime = lmp->l_msg_rtime; bmp->msg_ctime = lmp->l_msg_ctime; - bmp->_msg_cbytes = lmp->l_msg_cbytes; bmp->msg_qnum = lmp->l_msg_qnum; bmp->msg_qbytes = lmp->l_msg_qbytes; bmp->msg_lspid = lmp->l_msg_lspid; @@ -342,8 +347,6 @@ bsd_to_linux_msqid_ds(struct msqid_ds *b memset(lmp, 0, sizeof(*lmp)); bsd_to_linux_ipc_perm(&bmp->msg_perm, &lmp->l_msg_perm); - lmp->l_msg_first = bmp->_msg_first; - lmp->l_msg_last = bmp->_msg_last; lmp->l_msg_cbytes = bmp->_msg_cbytes; lmp->l_msg_qnum = bmp->msg_qnum; lmp->l_msg_qbytes = bmp->msg_qbytes; @@ -360,6 +363,7 @@ bsd_to_linux_msqid64_ds(struct msqid_ds memset(lmp, 0, sizeof(*lmp)); bsd_to_linux_ipc64_perm(&bmp->msg_perm, &lmp->l_msg_perm); + lmp->l_msg_cbytes = bmp->_msg_cbytes; lmp->l_msg_stime = bmp->msg_stime; lmp->l_msg_rtime = bmp->msg_rtime; lmp->l_msg_ctime = bmp->msg_ctime; @@ -504,7 +508,6 @@ linux_to_bsd_shmid_ds(struct linux_shmid bsp->shm_atime = lsp->l_shm_atime; bsp->shm_dtime = lsp->l_shm_dtime; bsp->shm_ctime = lsp->l_shm_ctime; - bsp->_shm_internal = lsp->l_private2; /* XXX Oh well. */ } void @@ -519,13 +522,13 @@ linux_to_bsd_shmid64_ds(struct linux_shm bsp->shm_atime = lsp->l_shm_atime; bsp->shm_dtime = lsp->l_shm_dtime; bsp->shm_ctime = lsp->l_shm_ctime; - bsp->_shm_internal = (void*)lsp->l___unused5; /* XXX Oh well. */ } void bsd_to_linux_shmid_ds(struct shmid_ds *bsp, struct linux_shmid_ds *lsp) { + memset(lsp, 0, sizeof *lsp); bsd_to_linux_ipc_perm(&bsp->shm_perm, &lsp->l_shm_perm); lsp->l_shm_segsz = bsp->shm_segsz; lsp->l_shm_lpid = bsp->shm_lpid; @@ -534,12 +537,13 @@ bsd_to_linux_shmid_ds(struct shmid_ds *b lsp->l_shm_atime = bsp->shm_atime; lsp->l_shm_dtime = bsp->shm_dtime; lsp->l_shm_ctime = bsp->shm_ctime; - lsp->l_private2 = bsp->_shm_internal; /* XXX */ } void bsd_to_linux_shmid64_ds(struct shmid_ds *bsp, struct linux_shmid64_ds *lsp) { + + memset(lsp, 0, sizeof *lsp); bsd_to_linux_ipc64_perm(&bsp->shm_perm, &lsp->l_shm_perm); lsp->l_shm_segsz = bsp->shm_segsz; lsp->l_shm_lpid = bsp->shm_lpid; @@ -548,7 +552,6 @@ bsd_to_linux_shmid64_ds(struct shmid_ds lsp->l_shm_atime = bsp->shm_atime; lsp->l_shm_dtime = bsp->shm_dtime; lsp->l_shm_ctime = bsp->shm_ctime; - lsp->l___unused5 = (u_long)bsp->_shm_internal; /* XXX */ } /* Index: src/sys/compat/linux32/common/linux32_ipccall.c diff -u src/sys/compat/linux32/common/linux32_ipccall.c:1.11 src/sys/compat/linux32/common/linux32_ipccall.c:1.12 --- src/sys/compat/linux32/common/linux32_ipccall.c:1.11 Sat May 29 18:55:34 2010 +++ src/sys/compat/linux32/common/linux32_ipccall.c Thu Feb 21 03:37:18 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: linux32_ipccall.c,v 1.11 2010/05/29 18:55:34 dholland Exp $ */ +/* $NetBSD: linux32_ipccall.c,v 1.12 2019/02/21 03:37:18 mrg Exp $ */ /* * Copyright (c) 2008 Nicolas Joly @@ -27,7 +27,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: linux32_ipccall.c,v 1.11 2010/05/29 18:55:34 dholland Exp $"); +__KERNEL_RCSID(0, "$NetBSD: linux32_ipccall.c,v 1.12 2019/02/21 03:37:18 mrg Exp $"); #if defined(_KERNEL_OPT) #include "opt_sysv.h" @@ -157,13 +157,14 @@ linux32_sys_ipc(struct lwp *l, const str default: return ENOSYS; } - } #if defined(SYSVSEM) || defined (SYSVMSG) || defined(SYSVSHM) static void bsd_to_linux32_ipc_perm(struct ipc_perm *bpp, struct linux32_ipc_perm *lpp) { + + memset(lpp, 0, sizeof *lpp); lpp->l_key = bpp->_key; lpp->l_uid = bpp->uid; lpp->l_gid = bpp->gid; @@ -176,6 +177,7 @@ bsd_to_linux32_ipc_perm(struct ipc_perm static void linux32_to_bsd_ipc_perm(struct linux32_ipc_perm *lpp, struct ipc_perm *bpp) { + bpp->_key = lpp->l_key; bpp->uid = lpp->l_uid; bpp->gid = lpp->l_gid; @@ -188,6 +190,8 @@ linux32_to_bsd_ipc_perm(struct linux32_i static void bsd_to_linux32_ipc64_perm(struct ipc_perm *bpp, struct linux32_ipc64_perm *lpp) { + + memset(lpp, 0, sizeof *lpp); lpp->l_key = bpp->_key; lpp->l_uid = bpp->uid; lpp->l_gid = bpp->gid; @@ -200,6 +204,7 @@ bsd_to_linux32_ipc64_perm(struct ipc_per static void linux32_to_bsd_ipc64_perm(struct linux32_ipc64_perm *lpp, struct ipc_perm *bpp) { + bpp->_key = lpp->l_key; bpp->uid = lpp->l_uid; bpp->gid = lpp->l_gid; @@ -214,16 +219,19 @@ linux32_to_bsd_ipc64_perm(struct linux32 static void bsd_to_linux32_semid_ds(struct semid_ds *bsp, struct linux32_semid_ds *lsp) { + + memset(lsp, 0, sizeof *lsp); bsd_to_linux32_ipc_perm(&bsp->sem_perm, &lsp->l_sem_perm); lsp->l_sem_otime = bsp->sem_otime; lsp->l_sem_ctime = bsp->sem_ctime; lsp->l_sem_nsems = bsp->sem_nsems; - NETBSD32PTR32(lsp->l_sem_base, bsp->_sem_base); } static void bsd_to_linux32_semid64_ds(struct semid_ds *bsp, struct linux32_semid64_ds *lsp) { + + memset(lsp, 0, sizeof *lsp); bsd_to_linux32_ipc64_perm(&bsp->sem_perm, &lsp->l_sem_perm); lsp->l_sem_otime = bsp->sem_otime; lsp->l_sem_ctime = bsp->sem_ctime; @@ -237,7 +245,6 @@ linux32_to_bsd_semid_ds(struct linux32_s bsp->sem_otime = lsp->l_sem_otime; bsp->sem_ctime = lsp->l_sem_ctime; bsp->sem_nsems = lsp->l_sem_nsems; - bsp->_sem_base = NETBSD32PTR64(lsp->l_sem_base); } static void @@ -428,8 +435,6 @@ linux32_to_bsd_msqid_ds(struct linux32_m memset(bmp, 0, sizeof(*bmp)); linux32_to_bsd_ipc_perm(&lmp->l_msg_perm, &bmp->msg_perm); - bmp->_msg_first = NETBSD32PTR64(lmp->l_msg_first); - bmp->_msg_last = NETBSD32PTR64(lmp->l_msg_last); bmp->_msg_cbytes = lmp->l_msg_cbytes; bmp->msg_qnum = lmp->l_msg_qnum; bmp->msg_qbytes = lmp->l_msg_qbytes; @@ -444,12 +449,11 @@ static void linux32_to_bsd_msqid64_ds(struct linux32_msqid64_ds *lmp, struct msqid_ds *bmp) { - memset(bmp, 0, sizeof(*bmp)); linux32_to_bsd_ipc64_perm(&lmp->l_msg_perm, &bmp->msg_perm); + bmp->_msg_cbytes = lmp->l_msg_cbytes; bmp->msg_stime = lmp->l_msg_stime; bmp->msg_rtime = lmp->l_msg_rtime; bmp->msg_ctime = lmp->l_msg_ctime; - bmp->_msg_cbytes = lmp->l_msg_cbytes; bmp->msg_qnum = lmp->l_msg_qnum; bmp->msg_qbytes = lmp->l_msg_qbytes; bmp->msg_lspid = lmp->l_msg_lspid; @@ -462,8 +466,6 @@ bsd_to_linux32_msqid_ds(struct msqid_ds memset(lmp, 0, sizeof(*lmp)); bsd_to_linux32_ipc_perm(&bmp->msg_perm, &lmp->l_msg_perm); - NETBSD32PTR32(lmp->l_msg_first, bmp->_msg_first); - NETBSD32PTR32(lmp->l_msg_last, bmp->_msg_last); lmp->l_msg_cbytes = bmp->_msg_cbytes; lmp->l_msg_qnum = bmp->msg_qnum; lmp->l_msg_qbytes = bmp->msg_qbytes; @@ -480,10 +482,10 @@ bsd_to_linux32_msqid64_ds(struct msqid_d memset(lmp, 0, sizeof(*lmp)); bsd_to_linux32_ipc64_perm(&bmp->msg_perm, &lmp->l_msg_perm); + lmp->l_msg_cbytes = bmp->_msg_cbytes; lmp->l_msg_stime = bmp->msg_stime; lmp->l_msg_rtime = bmp->msg_rtime; lmp->l_msg_ctime = bmp->msg_ctime; - lmp->l_msg_cbytes = bmp->_msg_cbytes; lmp->l_msg_qnum = bmp->msg_qnum; lmp->l_msg_qbytes = bmp->msg_qbytes; lmp->l_msg_lspid = bmp->msg_lspid; @@ -550,6 +552,8 @@ linux32_msgctl(struct lwp *l, const stru static void bsd_to_linux32_shmid_ds(struct shmid_ds *bsp, struct linux32_shmid_ds *lsp) { + + memset(lsp, 0, sizeof *lsp); bsd_to_linux32_ipc_perm(&bsp->shm_perm, &lsp->l_shm_perm); lsp->l_shm_segsz = bsp->shm_segsz; lsp->l_shm_atime = bsp->shm_atime; @@ -558,12 +562,12 @@ bsd_to_linux32_shmid_ds(struct shmid_ds lsp->l_shm_cpid = bsp->shm_cpid; lsp->l_shm_lpid = bsp->shm_lpid; lsp->l_shm_nattch = bsp->shm_nattch; - NETBSD32PTR32(lsp->l_private2, bsp->_shm_internal); } static void linux32_to_bsd_shmid_ds(struct linux32_shmid_ds *lsp, struct shmid_ds *bsp) { + linux32_to_bsd_ipc_perm(&lsp->l_shm_perm, &bsp->shm_perm); bsp->shm_segsz = lsp->l_shm_segsz; bsp->shm_atime = lsp->l_shm_atime; @@ -572,12 +576,13 @@ linux32_to_bsd_shmid_ds(struct linux32_s bsp->shm_cpid = lsp->l_shm_cpid; bsp->shm_lpid = lsp->l_shm_lpid; bsp->shm_nattch = lsp->l_shm_nattch; - bsp->_shm_internal = NETBSD32PTR64(lsp->l_private2); } static void bsd_to_linux32_shmid64_ds(struct shmid_ds *bsp, struct linux32_shmid64_ds *lsp) { + + memset(lsp, 0, sizeof *lsp); bsd_to_linux32_ipc64_perm(&bsp->shm_perm, &lsp->l_shm_perm); lsp->l_shm_segsz = bsp->shm_segsz; lsp->l_shm_atime = bsp->shm_atime; @@ -586,12 +591,12 @@ bsd_to_linux32_shmid64_ds(struct shmid_d lsp->l_shm_cpid = bsp->shm_cpid; lsp->l_shm_lpid = bsp->shm_lpid; lsp->l_shm_nattch = bsp->shm_nattch; - lsp->l___unused5 = NETBSD32PTR32I(bsp->_shm_internal); } static void linux32_to_bsd_shmid64_ds(struct linux32_shmid64_ds *lsp, struct shmid_ds *bsp) { + linux32_to_bsd_ipc64_perm(&lsp->l_shm_perm, &bsp->shm_perm); bsp->shm_segsz = lsp->l_shm_segsz; bsp->shm_atime = lsp->l_shm_atime; @@ -600,7 +605,6 @@ linux32_to_bsd_shmid64_ds(struct linux32 bsp->shm_cpid = lsp->l_shm_cpid; bsp->shm_lpid = lsp->l_shm_lpid; bsp->shm_nattch = lsp->l_shm_nattch; - bsp->_shm_internal = NETBSD32IPTR64(lsp->l___unused5); } static int Index: src/sys/compat/netbsd32/netbsd32_compat_14.c diff -u src/sys/compat/netbsd32/netbsd32_compat_14.c:1.27 src/sys/compat/netbsd32/netbsd32_compat_14.c:1.28 --- src/sys/compat/netbsd32/netbsd32_compat_14.c:1.27 Thu Dec 27 09:57:16 2018 +++ src/sys/compat/netbsd32/netbsd32_compat_14.c Thu Feb 21 03:37:19 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: netbsd32_compat_14.c,v 1.27 2018/12/27 09:57:16 maxv Exp $ */ +/* $NetBSD: netbsd32_compat_14.c,v 1.28 2019/02/21 03:37:19 mrg Exp $ */ /* * Copyright (c) 1999 Eduardo E. Horvath @@ -29,7 +29,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: netbsd32_compat_14.c,v 1.27 2018/12/27 09:57:16 maxv Exp $"); +__KERNEL_RCSID(0, "$NetBSD: netbsd32_compat_14.c,v 1.28 2019/02/21 03:37:19 mrg Exp $"); #ifdef _KERNEL_OPT #include "opt_sysv.h" @@ -71,6 +71,7 @@ static inline void native_to_netbsd32_ipc_perm14(struct ipc_perm *perm, struct netbsd32_ipc_perm14 *operm) { + memset(operm, 0, sizeof *operm); #define CVT(x) operm->x = perm->x CVT(uid); CVT(gid); @@ -107,7 +108,7 @@ static inline void native_to_netbsd32_msqid_ds14(struct msqid_ds *msqbuf, struct netbsd32_msqid_ds14 *omsqbuf) { - memset(omsqbuf, 0, sizeof(*omsqbuf)); + memset(omsqbuf, 0, sizeof *omsqbuf); native_to_netbsd32_ipc_perm14(&msqbuf->msg_perm, &omsqbuf->msg_perm); #define CVT(x) omsqbuf->x = msqbuf->x @@ -145,6 +146,7 @@ static inline void native_to_netbsd32_semid_ds14(struct semid_ds *sembuf, struct netbsd32_semid_ds14 *osembuf) { + memset(omsemuf, 0, sizeof *osembuf); native_to_netbsd32_ipc_perm14(&sembuf->sem_perm, &osembuf->sem_perm); #define CVT(x) osembuf->x = sembuf->x @@ -175,6 +177,7 @@ static inline void native_to_netbsd32_shmid_ds14(struct shmid_ds *shmbuf, struct netbsd32_shmid_ds14 *oshmbuf) { + memset(omshmuf, 0, sizeof *oshmbuf); native_to_netbsd32_ipc_perm14(&shmbuf->shm_perm, &oshmbuf->shm_perm); #define CVT(x) oshmbuf->x = shmbuf->x Index: src/sys/compat/netbsd32/netbsd32_compat_14_sysv.c diff -u src/sys/compat/netbsd32/netbsd32_compat_14_sysv.c:1.2 src/sys/compat/netbsd32/netbsd32_compat_14_sysv.c:1.3 --- src/sys/compat/netbsd32/netbsd32_compat_14_sysv.c:1.2 Sun Jan 27 02:08:40 2019 +++ src/sys/compat/netbsd32/netbsd32_compat_14_sysv.c Thu Feb 21 03:37:19 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: netbsd32_compat_14_sysv.c,v 1.2 2019/01/27 02:08:40 pgoyette Exp $ */ +/* $NetBSD: netbsd32_compat_14_sysv.c,v 1.3 2019/02/21 03:37:19 mrg Exp $ */ /* * Copyright (c) 1999 Eduardo E. Horvath @@ -29,7 +29,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: netbsd32_compat_14_sysv.c,v 1.2 2019/01/27 02:08:40 pgoyette Exp $"); +__KERNEL_RCSID(0, "$NetBSD: netbsd32_compat_14_sysv.c,v 1.3 2019/02/21 03:37:19 mrg Exp $"); #ifdef _KERNEL_OPT #include "opt_sysv.h" @@ -76,6 +76,7 @@ static inline void native_to_netbsd32_ipc_perm14(struct ipc_perm *perm, struct netbsd32_ipc_perm14 *operm) { + memset(operm, 0, sizeof *operm); #define CVT(x) operm->x = perm->x CVT(uid); CVT(gid); @@ -112,7 +113,7 @@ static inline void native_to_netbsd32_msqid_ds14(struct msqid_ds *msqbuf, struct netbsd32_msqid_ds14 *omsqbuf) { - memset(omsqbuf, 0, sizeof(*omsqbuf)); + memset(omsqbuf, 0, sizeof *omsqbuf); native_to_netbsd32_ipc_perm14(&msqbuf->msg_perm, &omsqbuf->msg_perm); #define CVT(x) omsqbuf->x = msqbuf->x @@ -150,6 +151,7 @@ static inline void native_to_netbsd32_semid_ds14(struct semid_ds *sembuf, struct netbsd32_semid_ds14 *osembuf) { + memset(osembuf, 0, sizeof *osembuf); native_to_netbsd32_ipc_perm14(&sembuf->sem_perm, &osembuf->sem_perm); #define CVT(x) osembuf->x = sembuf->x @@ -180,6 +182,7 @@ static inline void native_to_netbsd32_shmid_ds14(struct shmid_ds *shmbuf, struct netbsd32_shmid_ds14 *oshmbuf) { + memset(oshmbuf, 0, sizeof *oshmbuf); native_to_netbsd32_ipc_perm14(&shmbuf->shm_perm, &oshmbuf->shm_perm); #define CVT(x) oshmbuf->x = shmbuf->x Index: src/sys/compat/netbsd32/netbsd32_conv.h diff -u src/sys/compat/netbsd32/netbsd32_conv.h:1.37 src/sys/compat/netbsd32/netbsd32_conv.h:1.38 --- src/sys/compat/netbsd32/netbsd32_conv.h:1.37 Thu Dec 27 09:57:16 2018 +++ src/sys/compat/netbsd32/netbsd32_conv.h Thu Feb 21 03:37:19 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: netbsd32_conv.h,v 1.37 2018/12/27 09:57:16 maxv Exp $ */ +/* $NetBSD: netbsd32_conv.h,v 1.38 2019/02/21 03:37:19 mrg Exp $ */ /* * Copyright (c) 1998, 2001 Matthew R. Green @@ -395,7 +395,7 @@ netbsd32_to_timex(const struct netbsd32_ static __inline void netbsd32_from___stat13(const struct stat *sbp, struct netbsd32_stat13 *sb32p) { - memset(sb32p, 0, sizeof(*sb32p)); + memset(sb32p, 0, sizeof *sb32p); sb32p->st_dev = (uint32_t)sbp->st_dev; sb32p->st_ino = sbp->st_ino; sb32p->st_mode = sbp->st_mode; @@ -421,7 +421,7 @@ netbsd32_from___stat13(const struct stat static __inline void netbsd32_from___stat50(const struct stat *sbp, struct netbsd32_stat50 *sb32p) { - memset(sb32p, 0, sizeof(*sb32p)); + memset(sb32p, 0, sizeof *sb32p); sb32p->st_dev = (uint32_t)sbp->st_dev; sb32p->st_ino = sbp->st_ino; sb32p->st_mode = sbp->st_mode; @@ -447,7 +447,7 @@ netbsd32_from___stat50(const struct stat static __inline void netbsd32_from_stat(const struct stat *sbp, struct netbsd32_stat *sb32p) { - memset(sb32p, 0, sizeof(*sb32p)); + memset(sb32p, 0, sizeof *sb32p); sb32p->st_dev = sbp->st_dev; sb32p->st_ino = sbp->st_ino; sb32p->st_mode = sbp->st_mode; @@ -489,6 +489,7 @@ netbsd32_from_ipc_perm(const struct ipc_ struct netbsd32_ipc_perm *ip32p) { + memset(ip32p, 0, sizeof *ip32p); ip32p->cuid = ipp->cuid; ip32p->cgid = ipp->cgid; ip32p->uid = ipp->uid; @@ -512,6 +513,7 @@ static __inline void netbsd32_from_msg(const struct msg *mp, struct netbsd32_msg *m32p) { + memset(m32p, 0, sizeof *m32p); NETBSD32PTR32(m32p->msg_next, mp->msg_next); m32p->msg_type = (netbsd32_long)mp->msg_type; m32p->msg_ts = mp->msg_ts; @@ -555,7 +557,7 @@ netbsd32_from_msqid_ds50(const struct ms struct netbsd32_msqid_ds50 *ds32p) { - memset(ds32p, 0, sizeof(*ds32p)); + memset(ds32p, 0, sizeof *ds32p); netbsd32_from_ipc_perm(&dsp->msg_perm, &ds32p->msg_perm); ds32p->_msg_cbytes = (netbsd32_u_long)dsp->_msg_cbytes; ds32p->msg_qnum = (netbsd32_u_long)dsp->msg_qnum; @@ -572,7 +574,7 @@ netbsd32_from_msqid_ds(const struct msqi struct netbsd32_msqid_ds *ds32p) { - memset(ds32p, 0, sizeof(*ds32p)); + memset(ds32p, 0, sizeof *ds32p); netbsd32_from_ipc_perm(&dsp->msg_perm, &ds32p->msg_perm); ds32p->_msg_cbytes = (netbsd32_u_long)dsp->_msg_cbytes; ds32p->msg_qnum = (netbsd32_u_long)dsp->msg_qnum; @@ -597,7 +599,6 @@ netbsd32_to_shmid_ds50(const struct netb dsp->shm_atime = (time_t)ds32p->shm_atime; dsp->shm_dtime = (time_t)ds32p->shm_dtime; dsp->shm_ctime = (time_t)ds32p->shm_ctime; - dsp->_shm_internal = NETBSD32PTR64(ds32p->_shm_internal); } static __inline void @@ -613,7 +614,6 @@ netbsd32_to_shmid_ds(const struct netbsd dsp->shm_atime = (long)ds32p->shm_atime; dsp->shm_dtime = (time_t)ds32p->shm_dtime; dsp->shm_ctime = (time_t)ds32p->shm_ctime; - dsp->_shm_internal = NETBSD32PTR64(ds32p->_shm_internal); } static __inline void @@ -621,6 +621,7 @@ netbsd32_from_shmid_ds50(const struct sh struct netbsd32_shmid_ds50 *ds32p) { + memset(ds32p, 0, sizeof *ds32p); netbsd32_from_ipc_perm(&dsp->shm_perm, &ds32p->shm_perm); ds32p->shm_segsz = dsp->shm_segsz; ds32p->shm_lpid = dsp->shm_lpid; @@ -629,7 +630,6 @@ netbsd32_from_shmid_ds50(const struct sh ds32p->shm_atime = (int32_t)dsp->shm_atime; ds32p->shm_dtime = (int32_t)dsp->shm_dtime; ds32p->shm_ctime = (int32_t)dsp->shm_ctime; - NETBSD32PTR32(ds32p->_shm_internal, dsp->_shm_internal); } static __inline void @@ -637,6 +637,7 @@ netbsd32_from_shmid_ds(const struct shmi struct netbsd32_shmid_ds *ds32p) { + memset(ds32p, 0, sizeof *ds32p); netbsd32_from_ipc_perm(&dsp->shm_perm, &ds32p->shm_perm); ds32p->shm_segsz = dsp->shm_segsz; ds32p->shm_lpid = dsp->shm_lpid; @@ -645,7 +646,6 @@ netbsd32_from_shmid_ds(const struct shmi ds32p->shm_atime = (netbsd32_long)dsp->shm_atime; ds32p->shm_dtime = (netbsd32_long)dsp->shm_dtime; ds32p->shm_ctime = (netbsd32_long)dsp->shm_ctime; - NETBSD32PTR32(ds32p->_shm_internal, dsp->_shm_internal); } static __inline void @@ -654,7 +654,6 @@ netbsd32_to_semid_ds50(const struct netb { netbsd32_to_ipc_perm(&s32dsp->sem_perm, &dsp->sem_perm); - dsp->_sem_base = NETBSD32PTR64(s32dsp->_sem_base); dsp->sem_nsems = (time_t)s32dsp->sem_nsems; dsp->sem_otime = (time_t)s32dsp->sem_otime; dsp->sem_ctime = (time_t)s32dsp->sem_ctime; @@ -666,7 +665,6 @@ netbsd32_to_semid_ds(const struct netbsd { netbsd32_to_ipc_perm(&s32dsp->sem_perm, &dsp->sem_perm); - dsp->_sem_base = NETBSD32PTR64(s32dsp->_sem_base); dsp->sem_nsems = s32dsp->sem_nsems; dsp->sem_otime = s32dsp->sem_otime; dsp->sem_ctime = s32dsp->sem_ctime; @@ -677,8 +675,8 @@ netbsd32_from_semid_ds50(const struct se struct netbsd32_semid_ds50 *s32dsp) { + memset(s32dsp, 0, sizeof *s32dsp); netbsd32_from_ipc_perm(&dsp->sem_perm, &s32dsp->sem_perm); - NETBSD32PTR32(s32dsp->_sem_base, dsp->_sem_base); s32dsp->sem_nsems = (int32_t)dsp->sem_nsems; s32dsp->sem_otime = (int32_t)dsp->sem_otime; s32dsp->sem_ctime = (int32_t)dsp->sem_ctime; @@ -689,8 +687,8 @@ netbsd32_from_semid_ds(const struct semi struct netbsd32_semid_ds *s32dsp) { + memset(s32dsp, 0, sizeof *s32dsp); netbsd32_from_ipc_perm(&dsp->sem_perm, &s32dsp->sem_perm); - NETBSD32PTR32(s32dsp->_sem_base, dsp->_sem_base); s32dsp->sem_nsems = dsp->sem_nsems; s32dsp->sem_otime = dsp->sem_otime; s32dsp->sem_ctime = dsp->sem_ctime; Index: src/sys/compat/sys/ipc.h diff -u src/sys/compat/sys/ipc.h:1.5 src/sys/compat/sys/ipc.h:1.6 --- src/sys/compat/sys/ipc.h:1.5 Thu Apr 19 21:50:08 2018 +++ src/sys/compat/sys/ipc.h Thu Feb 21 03:37:19 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: ipc.h,v 1.5 2018/04/19 21:50:08 christos Exp $ */ +/* $NetBSD: ipc.h,v 1.6 2019/02/21 03:37:19 mrg Exp $ */ /* * Copyright (c) 1990, 1993 @@ -68,6 +68,7 @@ static __inline void __ipc_perm14_to_native(const struct ipc_perm14 *operm, struct ipc_perm *perm) { + memset(perm, 0, sizeof *perm); #define CVT(x) perm->x = operm->x CVT(uid); CVT(gid); @@ -81,6 +82,7 @@ static __inline void __native_to_ipc_perm14(const struct ipc_perm *perm, struct ipc_perm14 *operm) { + memset(operm, 0, sizeof *operm); #define CVT(x) operm->x = perm->x CVT(uid); CVT(gid); Index: src/sys/compat/sys/msg.h diff -u src/sys/compat/sys/msg.h:1.5 src/sys/compat/sys/msg.h:1.6 --- src/sys/compat/sys/msg.h:1.5 Thu Dec 27 09:57:16 2018 +++ src/sys/compat/sys/msg.h Thu Feb 21 03:37:19 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: msg.h,v 1.5 2018/12/27 09:57:16 maxv Exp $ */ +/* $NetBSD: msg.h,v 1.6 2019/02/21 03:37:19 mrg Exp $ */ /* * SVID compatible msg.h file @@ -91,6 +91,7 @@ static __inline void __msqid_ds13_to_native(const struct msqid_ds13 *omsqbuf, struct msqid_ds *msqbuf) { + memset(msqbuf, 0, sizeof *msqbuf); msqbuf->msg_perm = omsqbuf->msg_perm; #define CVT(x) msqbuf->x = omsqbuf->x @@ -133,6 +134,7 @@ static __inline void __msqid_ds14_to_native(const struct msqid_ds14 *omsqbuf, struct msqid_ds *msqbuf) { + memset(msqbuf, 0, sizeof *msqbuf); __ipc_perm14_to_native(&omsqbuf->msg_perm, &msqbuf->msg_perm); #define CVT(x) msqbuf->x = omsqbuf->x @@ -150,7 +152,7 @@ static __inline void __native_to_msqid_ds14(const struct msqid_ds *msqbuf, struct msqid_ds14 *omsqbuf) { - memset(omsqbuf, 0, sizeof(*omsqbuf)); + memset(omsqbuf, 0, sizeof *omsqbuf); __native_to_ipc_perm14(&msqbuf->msg_perm, &omsqbuf->msg_perm); #define CVT(x) omsqbuf->x = msqbuf->x Index: src/sys/compat/sys/sem.h diff -u src/sys/compat/sys/sem.h:1.6 src/sys/compat/sys/sem.h:1.7 --- src/sys/compat/sys/sem.h:1.6 Mon Jan 19 19:39:41 2009 +++ src/sys/compat/sys/sem.h Thu Feb 21 03:37:19 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: sem.h,v 1.6 2009/01/19 19:39:41 christos Exp $ */ +/* $NetBSD: sem.h,v 1.7 2019/02/21 03:37:19 mrg Exp $ */ /* * SVID compatible sem.h file @@ -75,6 +75,7 @@ static __inline void __native_to_semid_ds13(const struct semid_ds *sembuf, struct semid_ds13 *osembuf) { + memset(osembuf, 0, sizeof *osembuf); osembuf->sem_perm = sembuf->sem_perm; #define CVT(x) osembuf->x = sembuf->x @@ -103,6 +104,7 @@ static __inline void __native_to_semid_ds14(const struct semid_ds *sembuf, struct semid_ds14 *osembuf) { + memset(osembuf, 0, sizeof *osembuf); __native_to_ipc_perm14(&sembuf->sem_perm, &osembuf->sem_perm); #define CVT(x) osembuf->x = sembuf->x Index: src/sys/compat/sys/shm.h diff -u src/sys/compat/sys/shm.h:1.7 src/sys/compat/sys/shm.h:1.8 --- src/sys/compat/sys/shm.h:1.7 Wed Apr 1 21:15:23 2009 +++ src/sys/compat/sys/shm.h Thu Feb 21 03:37:19 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: shm.h,v 1.7 2009/04/01 21:15:23 christos Exp $ */ +/* $NetBSD: shm.h,v 1.8 2019/02/21 03:37:19 mrg Exp $ */ /* * Copyright (c) 1994 Adam Glass @@ -111,6 +111,7 @@ static __inline void __native_to_shmid_ds14(const struct shmid_ds *shmbuf, struct shmid_ds14 *oshmbuf) { + memset(oshmbuf, 0, sizeof *oshmbuf); __native_to_ipc_perm14(&shmbuf->shm_perm, &oshmbuf->shm_perm); #define CVT(x) oshmbuf->x = shmbuf->x @@ -147,6 +148,7 @@ static __inline void __native_to_shmid_ds13(const struct shmid_ds *shmbuf, struct shmid_ds13 *oshmbuf) { + memset(oshmbuf, 0, sizeof *oshmbuf); oshmbuf->shm_perm = shmbuf->shm_perm; #define CVT(x) oshmbuf->x = shmbuf->x Index: src/sys/kern/sysv_msg.c diff -u src/sys/kern/sysv_msg.c:1.72 src/sys/kern/sysv_msg.c:1.73 --- src/sys/kern/sysv_msg.c:1.72 Fri Mar 30 22:54:37 2018 +++ src/sys/kern/sysv_msg.c Thu Feb 21 03:37:19 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: sysv_msg.c,v 1.72 2018/03/30 22:54:37 maya Exp $ */ +/* $NetBSD: sysv_msg.c,v 1.73 2019/02/21 03:37:19 mrg Exp $ */ /*- * Copyright (c) 1999, 2006, 2007 The NetBSD Foundation, Inc. @@ -50,7 +50,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: sysv_msg.c,v 1.72 2018/03/30 22:54:37 maya Exp $"); +__KERNEL_RCSID(0, "$NetBSD: sysv_msg.c,v 1.73 2019/02/21 03:37:19 mrg Exp $"); #ifdef _KERNEL_OPT #include "opt_sysv.h" @@ -566,7 +566,16 @@ msgctl1(struct lwp *l, int msqid, int cm MSG_PRINTF(("requester doesn't have read access\n")); break; } - memcpy(msqbuf, msqptr, sizeof(struct msqid_ds)); + memset(msqbuf, 0, sizeof *msqbuf); + msqbuf->msg_perm = msqptr->msg_perm; + msqbuf->msg_perm.mode &= 0777; + msqbuf->msg_qnum = msqptr->msg_qnum; + msqbuf->msg_qbytes = msqptr->msg_qbytes; + msqbuf->msg_lspid = msqptr->msg_lspid; + msqbuf->msg_lrpid = msqptr->msg_lrpid; + msqbuf->msg_stime = msqptr->msg_stime; + msqbuf->msg_rtime = msqptr->msg_rtime; + msqbuf->msg_ctime = msqptr->msg_ctime; break; default: Index: src/sys/kern/sysv_sem.c diff -u src/sys/kern/sysv_sem.c:1.95 src/sys/kern/sysv_sem.c:1.96 --- src/sys/kern/sysv_sem.c:1.95 Fri Nov 6 02:26:42 2015 +++ src/sys/kern/sysv_sem.c Thu Feb 21 03:37:19 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: sysv_sem.c,v 1.95 2015/11/06 02:26:42 pgoyette Exp $ */ +/* $NetBSD: sysv_sem.c,v 1.96 2019/02/21 03:37:19 mrg Exp $ */ /*- * Copyright (c) 1999, 2007 The NetBSD Foundation, Inc. @@ -39,7 +39,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: sysv_sem.c,v 1.95 2015/11/06 02:26:42 pgoyette Exp $"); +__KERNEL_RCSID(0, "$NetBSD: sysv_sem.c,v 1.96 2019/02/21 03:37:19 mrg Exp $"); #ifdef _KERNEL_OPT #include "opt_sysv.h" @@ -593,8 +593,12 @@ semctl1(struct lwp *l, int semid, int se if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R))) break; KASSERT(sembuf != NULL); - memcpy(sembuf, semaptr, sizeof(struct semid_ds)); + memset(sembuf, 0, sizeof *sembuf); + sembuf->sem_perm = semaptr->sem_perm; sembuf->sem_perm.mode &= 0777; + sembuf->sem_nsems = semaptr->sem_nsems; + sembuf->sem_otime = semaptr->sem_otime; + sembuf->sem_ctime = semaptr->sem_ctime; break; case GETNCNT: Index: src/sys/kern/sysv_shm.c diff -u src/sys/kern/sysv_shm.c:1.132 src/sys/kern/sysv_shm.c:1.133 --- src/sys/kern/sysv_shm.c:1.132 Mon Sep 3 16:29:35 2018 +++ src/sys/kern/sysv_shm.c Thu Feb 21 03:37:19 2019 @@ -1,4 +1,4 @@ -/* $NetBSD: sysv_shm.c,v 1.132 2018/09/03 16:29:35 riastradh Exp $ */ +/* $NetBSD: sysv_shm.c,v 1.133 2019/02/21 03:37:19 mrg Exp $ */ /*- * Copyright (c) 1999, 2007 The NetBSD Foundation, Inc. @@ -61,7 +61,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: sysv_shm.c,v 1.132 2018/09/03 16:29:35 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: sysv_shm.c,v 1.133 2019/02/21 03:37:19 mrg Exp $"); #ifdef _KERNEL_OPT #include "opt_sysv.h" @@ -557,7 +557,16 @@ shmctl1(struct lwp *l, int shmid, int cm case IPC_STAT: if ((error = ipcperm(cred, &shmseg->shm_perm, IPC_R)) != 0) break; - memcpy(shmbuf, shmseg, sizeof(struct shmid_ds)); + memset(shmbuf, 0, sizeof *shmbuf); + shmbuf->shm_perm = shmseg->shm_perm; + shmbuf->shm_perm.mode &= 0777; + shmbuf->shm_segsz = shmseg->shm_segsz; + shmbuf->shm_lpid = shmseg->shm_lpid; + shmbuf->shm_cpid = shmseg->shm_cpid; + shmbuf->shm_nattch = shmseg->shm_nattch; + shmbuf->shm_atime = shmseg->shm_atime; + shmbuf->shm_dtime = shmseg->shm_dtime; + shmbuf->shm_ctime = shmseg->shm_ctime; break; case IPC_SET: if ((error = ipcperm(cred, &shmseg->shm_perm, IPC_M)) != 0)