svn commit: r315657 - in stable/11/sys: compat/freebsd32 compat/linux kern

[Eric van Gyzen]

Author: vangyzen
Date: Tue Mar 21 01:23:34 2017
New Revision: 315657
URL: https://svnweb.freebsd.org/changeset/base/315657

Log:
  MFC r315510
  
  nanosleep: plug a kernel memory disclosure
  
  nanosleep() updates rmtp on EINVAL.  In that case, kern_nanosleep()
  has not updated rmt, so sys_nanosleep() updates the user-space rmtp
  by copying garbage from its stack frame.  This is not only a kernel
  memory disclosure, it's also not POSIX-compliant.  Fix it to update
  rmtp only on EINTR.
  
  Security:	possibly
  Sponsored by:	Dell EMC

Modified:
  stable/11/sys/compat/freebsd32/freebsd32_misc.c
  stable/11/sys/compat/linux/linux_time.c
  stable/11/sys/kern/kern_time.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/compat/freebsd32/freebsd32_misc.c
==============================================================================
--- stable/11/sys/compat/freebsd32/freebsd32_misc.c	Mon Mar 20 23:07:34 2017	(r315656)
+++ stable/11/sys/compat/freebsd32/freebsd32_misc.c	Tue Mar 21 01:23:34 2017	(r315657)
@@ -2241,7 +2241,7 @@ freebsd32_nanosleep(struct thread *td, s
 	    !useracc((caddr_t)uap->rmtp, sizeof(rmt), VM_PROT_WRITE))
 		return (EFAULT);
 	error = kern_nanosleep(td, &rqt, &rmt);
-	if (error && uap->rmtp) {
+	if (error == EINTR && uap->rmtp) {
 		int error2;
 
 		CP(rmt, rmt32, tv_sec);

Modified: stable/11/sys/compat/linux/linux_time.c
==============================================================================
--- stable/11/sys/compat/linux/linux_time.c	Mon Mar 20 23:07:34 2017	(r315656)
+++ stable/11/sys/compat/linux/linux_time.c	Tue Mar 21 01:23:34 2017	(r315657)
@@ -489,7 +489,7 @@ linux_nanosleep(struct thread *td, struc
 		return (error);
 	}
 	error = kern_nanosleep(td, &rqts, rmtp);
-	if (args->rmtp != NULL) {
+	if (error == EINTR && args->rmtp != NULL) {
 		native_to_linux_timespec(&lrmts, rmtp);
 		error2 = copyout(&lrmts, args->rmtp, sizeof(lrmts));
 		if (error2 != 0) {
@@ -551,7 +551,7 @@ linux_clock_nanosleep(struct thread *td,
 		return (error);
 	}
 	error = kern_nanosleep(td, &rqts, rmtp);
-	if (args->rmtp != NULL) {
+	if (error == EINTR && args->rmtp != NULL) {
 		/* XXX. Not for TIMER_ABSTIME */
 	   	native_to_linux_timespec(&lrmts, rmtp);
 		error2 = copyout(&lrmts, args->rmtp, sizeof(lrmts));

Modified: stable/11/sys/kern/kern_time.c
==============================================================================
--- stable/11/sys/kern/kern_time.c	Mon Mar 20 23:07:34 2017	(r315656)
+++ stable/11/sys/kern/kern_time.c	Tue Mar 21 01:23:34 2017	(r315657)
@@ -541,7 +541,7 @@ sys_nanosleep(struct thread *td, struct 
 	    !useracc((caddr_t)uap->rmtp, sizeof(rmt), VM_PROT_WRITE))
 			return (EFAULT);
 	error = kern_nanosleep(td, &rqt, &rmt);
-	if (error && uap->rmtp) {
+	if (error == EINTR && uap->rmtp) {
 		int error2;
 
 		error2 = copyout(&rmt, uap->rmtp, sizeof(rmt));