Author: markj
Date: Mon Jan 21 23:54:33 2019
New Revision: 343286
URL: https://svnweb.freebsd.org/changeset/base/343286
Log:
nfs: Zero the buffers exported by NFSSVC_DUMPCLIENTS and DUMPLOCKS.
Note that these interfaces are available only to root.
admbugs: 765
Reported by: Vlad Tsyrklevich <v...@tsyrklevich.net>
Reviewed by: rmacklem
MFC after: 1 day
Security: Kernel memory disclosure
Sponsored by: The FreeBSD Foundation
Modified:
head/sys/fs/nfsserver/nfs_nfsdport.c
Modified: head/sys/fs/nfsserver/nfs_nfsdport.c
==============================================================================
--- head/sys/fs/nfsserver/nfs_nfsdport.c Mon Jan 21 20:58:33 2019
(r343285)
+++ head/sys/fs/nfsserver/nfs_nfsdport.c Mon Jan 21 23:54:33 2019
(r343286)
@@ -3614,8 +3614,7 @@ nfssvc_srvcall(struct thread *p, struct nfssvc_args *u
error = EPERM;
if (!error) {
len = sizeof (struct nfsd_dumpclients) * dumplist.ndl_size;
- dumpclients = (struct nfsd_dumpclients *)malloc(len,
- M_TEMP, M_WAITOK);
+ dumpclients = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
nfsrv_dumpclients(dumpclients, dumplist.ndl_size);
error = copyout(dumpclients,
CAST_USER_ADDR_T(dumplist.ndl_list), len);
@@ -3633,8 +3632,7 @@ nfssvc_srvcall(struct thread *p, struct nfssvc_args *u
if (!error) {
len = sizeof (struct nfsd_dumplocks) *
dumplocklist.ndllck_size;
- dumplocks = (struct nfsd_dumplocks *)malloc(len,
- M_TEMP, M_WAITOK);
+ dumplocks = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
nfsrv_dumplocks(nd.ni_vp, dumplocks,
dumplocklist.ndllck_size, p);
vput(nd.ni_vp);
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
