Module Name: src Committed By: maxv Date: Wed Feb 26 18:00:12 UTC 2020
Modified Files: src/sys/ufs/ufs: ufs_vnops.c Log Message: Zero out the padding in 'd_namlen', to prevent info leaks. Same logic as ufs_makedirentry(). Found by kMSan: the unzeroed bytes of the pool_cache were getting copied to the disk via a DMA write operation, and there kMSan was noticing uninitialized memory leaving the system. Reported-by: syzbot+382c9dffc06a9683a...@syzkaller.appspotmail.com To generate a diff of this commit: cvs rdiff -u -r1.248 -r1.249 src/sys/ufs/ufs/ufs_vnops.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/ufs/ufs/ufs_vnops.c diff -u src/sys/ufs/ufs/ufs_vnops.c:1.248 src/sys/ufs/ufs/ufs_vnops.c:1.249 --- src/sys/ufs/ufs/ufs_vnops.c:1.248 Wed Sep 18 17:59:15 2019 +++ src/sys/ufs/ufs/ufs_vnops.c Wed Feb 26 18:00:12 2020 @@ -1,4 +1,4 @@ -/* $NetBSD: ufs_vnops.c,v 1.248 2019/09/18 17:59:15 christos Exp $ */ +/* $NetBSD: ufs_vnops.c,v 1.249 2020/02/26 18:00:12 maxv Exp $ */ /*- * Copyright (c) 2008 The NetBSD Foundation, Inc. @@ -66,7 +66,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ufs_vnops.c,v 1.248 2019/09/18 17:59:15 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ufs_vnops.c,v 1.249 2020/02/26 18:00:12 maxv Exp $"); #if defined(_KERNEL_OPT) #include "opt_ffs.h" @@ -873,7 +873,11 @@ ufs_whiteout(void *v) newdir->d_namlen = cnp->cn_namelen; memcpy(newdir->d_name, cnp->cn_nameptr, (size_t)cnp->cn_namelen); - newdir->d_name[cnp->cn_namelen] = '\0'; + + /* NUL terminate and zero out padding */ + memset(&newdir->d_name[cnp->cn_namelen], 0, + UFS_NAMEPAD(cnp->cn_namelen)); + newdir->d_type = DT_WHT; error = ufs_direnter(dvp, ulr, NULL, newdir, cnp, NULL); pool_cache_put(ufs_direct_cache, newdir);