Module Name: src
Committed By: martin
Date: Thu Jan 2 09:50:34 UTC 2020
Modified Files:
src/sys/compat/common [netbsd-9]: kern_sig_43.c
src/sys/compat/netbsd32 [netbsd-9]: netbsd32_compat_20.c
netbsd32_compat_43.c netbsd32_compat_50.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #597):
sys/compat/common/kern_sig_43.c: revision 1.36
sys/compat/netbsd32/netbsd32_compat_20.c: revision 1.39
sys/compat/netbsd32/netbsd32_compat_43.c: revision 1.59
sys/compat/netbsd32/netbsd32_compat_50.c: revision 1.44
Fix sizeof mismatch in copyin. This leads to a user-triggerable stack
overflow. On my test build at least, by luck, the compiler orders the
variables in a way that the overflow hits only local structures which
haven't yet been initialized and used, so the overflow is harmless.
Very easily seeable with kASan - just invoke the syscall from a 32bit
binary.
Fix three stack info leaks, found by kMSan when just invoking all syscalls
with a zero page as argument.
MSan: Uninitialized Stack Memory In copyout() At Offset 0, Variable 'sb32' From
compat_20_netbsd32_getfsstat()
MSan: Uninitialized Stack Memory In copyout() At Offset 12, Variable 'oss' From
compat_43_sys_sigstack()
MSan: Uninitialized Stack Memory In copyout() At Offset 0, Variable 'sb' From
compat_50_netbsd32___fhstat40()
To generate a diff of this commit:
cvs rdiff -u -r1.35 -r1.35.4.1 src/sys/compat/common/kern_sig_43.c
cvs rdiff -u -r1.38 -r1.38.4.1 src/sys/compat/netbsd32/netbsd32_compat_20.c
cvs rdiff -u -r1.57.4.1 -r1.57.4.2 \
src/sys/compat/netbsd32/netbsd32_compat_43.c
cvs rdiff -u -r1.39.2.1 -r1.39.2.2 \
src/sys/compat/netbsd32/netbsd32_compat_50.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/compat/common/kern_sig_43.c
diff -u src/sys/compat/common/kern_sig_43.c:1.35 src/sys/compat/common/kern_sig_43.c:1.35.4.1
--- src/sys/compat/common/kern_sig_43.c:1.35 Sun Jan 27 02:08:39 2019
+++ src/sys/compat/common/kern_sig_43.c Thu Jan 2 09:50:34 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_sig_43.c,v 1.35 2019/01/27 02:08:39 pgoyette Exp $ */
+/* $NetBSD: kern_sig_43.c,v 1.35.4.1 2020/01/02 09:50:34 martin Exp $ */
/*-
* Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_sig_43.c,v 1.35 2019/01/27 02:08:39 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_sig_43.c,v 1.35.4.1 2020/01/02 09:50:34 martin Exp $");
#if defined(_KERNEL_OPT)
#include "opt_compat_netbsd.h"
@@ -128,6 +128,7 @@ compat_43_sigstack_to_sigaltstack(const
void
compat_43_sigaltstack_to_sigstack(const struct sigaltstack *sa, struct sigstack *ss)
{
+ memset(ss, 0, sizeof(*ss));
ss->ss_sp = sa->ss_sp;
if (sa->ss_flags & SS_ONSTACK)
ss->ss_onstack = 1;
Index: src/sys/compat/netbsd32/netbsd32_compat_20.c
diff -u src/sys/compat/netbsd32/netbsd32_compat_20.c:1.38 src/sys/compat/netbsd32/netbsd32_compat_20.c:1.38.4.1
--- src/sys/compat/netbsd32/netbsd32_compat_20.c:1.38 Sun Jan 27 02:08:40 2019
+++ src/sys/compat/netbsd32/netbsd32_compat_20.c Thu Jan 2 09:50:34 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: netbsd32_compat_20.c,v 1.38 2019/01/27 02:08:40 pgoyette Exp $ */
+/* $NetBSD: netbsd32_compat_20.c,v 1.38.4.1 2020/01/02 09:50:34 martin Exp $ */
/*
* Copyright (c) 1998, 2001 Matthew R. Green
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: netbsd32_compat_20.c,v 1.38 2019/01/27 02:08:40 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: netbsd32_compat_20.c,v 1.38.4.1 2020/01/02 09:50:34 martin Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -57,6 +57,7 @@ static inline void compat_20_netbsd32_fr
static inline void
compat_20_netbsd32_from_statvfs(struct statvfs *sbp, struct netbsd32_statfs *sb32p)
{
+ sb32p->f_type = 0; /* XXX Put an actual value? */
sb32p->f_flags = sbp->f_flag;
sb32p->f_bsize = (netbsd32_long)sbp->f_bsize;
sb32p->f_iosize = (netbsd32_long)sbp->f_iosize;
Index: src/sys/compat/netbsd32/netbsd32_compat_43.c
diff -u src/sys/compat/netbsd32/netbsd32_compat_43.c:1.57.4.1 src/sys/compat/netbsd32/netbsd32_compat_43.c:1.57.4.2
--- src/sys/compat/netbsd32/netbsd32_compat_43.c:1.57.4.1 Fri Sep 13 06:25:26 2019
+++ src/sys/compat/netbsd32/netbsd32_compat_43.c Thu Jan 2 09:50:34 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: netbsd32_compat_43.c,v 1.57.4.1 2019/09/13 06:25:26 martin Exp $ */
+/* $NetBSD: netbsd32_compat_43.c,v 1.57.4.2 2020/01/02 09:50:34 martin Exp $ */
/*
* Copyright (c) 1998, 2001 Matthew R. Green
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: netbsd32_compat_43.c,v 1.57.4.1 2019/09/13 06:25:26 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: netbsd32_compat_43.c,v 1.57.4.2 2020/01/02 09:50:34 martin Exp $");
#if defined(_KERNEL_OPT)
#include "opt_compat_43.h"
@@ -433,7 +433,7 @@ compat_43_netbsd32_orecvmsg(struct lwp *
struct iovec *iov, aiov[UIO_SMALLIOV];
int error;
- error = copyin(SCARG_P32(uap, msg), &omsg, sizeof (struct omsghdr));
+ error = copyin(SCARG_P32(uap, msg), &omsg, sizeof(omsg));
if (error)
return (error);
@@ -518,7 +518,7 @@ compat_43_netbsd32_osendmsg(struct lwp *
struct sockaddr *sa;
int error;
- error = copyin(SCARG_P32(uap, msg), &omsg, sizeof (struct omsghdr));
+ error = copyin(SCARG_P32(uap, msg), &omsg, sizeof(omsg));
if (error != 0)
return (error);
Index: src/sys/compat/netbsd32/netbsd32_compat_50.c
diff -u src/sys/compat/netbsd32/netbsd32_compat_50.c:1.39.2.1 src/sys/compat/netbsd32/netbsd32_compat_50.c:1.39.2.2
--- src/sys/compat/netbsd32/netbsd32_compat_50.c:1.39.2.1 Wed Dec 18 20:04:32 2019
+++ src/sys/compat/netbsd32/netbsd32_compat_50.c Thu Jan 2 09:50:34 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: netbsd32_compat_50.c,v 1.39.2.1 2019/12/18 20:04:32 martin Exp $ */
+/* $NetBSD: netbsd32_compat_50.c,v 1.39.2.2 2020/01/02 09:50:34 martin Exp $ */
/*-
* Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -29,7 +29,7 @@
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: netbsd32_compat_50.c,v 1.39.2.1 2019/12/18 20:04:32 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: netbsd32_compat_50.c,v 1.39.2.2 2020/01/02 09:50:34 martin Exp $");
#if defined(_KERNEL_OPT)
#include "opt_compat_netbsd.h"
@@ -795,9 +795,9 @@ compat_50_netbsd32___fhstat40(struct lwp
int error;
error = do_fhstat(l, SCARG_P32(uap, fhp), SCARG(uap, fh_size), &sb);
- if (error != 0) {
+ if (error == 0) {
netbsd32_from___stat50(&sb, &sb32);
- error = copyout(&sb32, SCARG_P32(uap, sb), sizeof(sb));
+ error = copyout(&sb32, SCARG_P32(uap, sb), sizeof(sb32));
}
return error;
}
