Module Name: src
Committed By: uwe
Date: Wed Jun 13 02:09:09 UTC 2018
Modified Files:
src/sys/dev/wscons: wsevent.c
Log Message:
wsevent_copyout_events50 - don't leak garbage from the kernel stack.
On 64-bit machines struct timespec50 has padding between 32-bit tv_sec
and long tv_nsec that is not affected by normal assignment. Scrub it
before we uiomove struct owscons_event.
To generate a diff of this commit:
cvs rdiff -u -r1.37 -r1.38 src/sys/dev/wscons/wsevent.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/wscons/wsevent.c
diff -u src/sys/dev/wscons/wsevent.c:1.37 src/sys/dev/wscons/wsevent.c:1.38
--- src/sys/dev/wscons/wsevent.c:1.37 Wed Oct 25 08:12:39 2017
+++ src/sys/dev/wscons/wsevent.c Wed Jun 13 02:09:09 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: wsevent.c,v 1.37 2017/10/25 08:12:39 maya Exp $ */
+/* $NetBSD: wsevent.c,v 1.38 2018/06/13 02:09:09 uwe Exp $ */
/*-
* Copyright (c) 2006, 2008 The NetBSD Foundation, Inc.
@@ -104,7 +104,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: wsevent.c,v 1.37 2017/10/25 08:12:39 maya Exp $");
+__KERNEL_RCSID(0, "$NetBSD: wsevent.c,v 1.38 2018/06/13 02:09:09 uwe Exp $");
#ifdef _KERNEL_OPT
#include "opt_compat_netbsd.h"
@@ -202,6 +202,9 @@ wsevent_copyout_events50(const struct ws
ev50.type = ev->type;
ev50.value = ev->value;
+#if INT32_MAX < LONG_MAX /* scrub padding */
+ memset(&ev50.time, 0, offsetof(struct timespec50, tv_nsec));
+#endif
timespec_to_timespec50(&ev->time, &ev50.time);
error = uiomove(&ev50, sizeof(ev50), uio);
