svn commit: r332065 - stable/11/sys/compat/linux

[Ed Maste]

Author: emaste
Date: Thu Apr  5 12:54:12 2018
New Revision: 332065
URL: https://svnweb.freebsd.org/changeset/base/332065

Log:
  MFC r332042: Fix kernel memory disclosure in linux_ioctl_socket
  
  strlcpy is used to copy a string into a buffer to be copied to userland,
  previously leaving uninitialized data after the terminating NUL.  Zero
  the buffer first to avoid a kernel memory disclosure.
  
  admbugs:	765, 811
  Reported by:	Ilja Van Sprundel <ivansprundel at ioactive.com>
  Reported by:	Vlad Tsyrklevich
  Sponsored by:	The FreeBSD Foundation

Modified:
  stable/11/sys/compat/linux/linux_ioctl.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/compat/linux/linux_ioctl.c
==============================================================================
--- stable/11/sys/compat/linux/linux_ioctl.c	Thu Apr  5 12:54:10 2018	(r332064)
+++ stable/11/sys/compat/linux/linux_ioctl.c	Thu Apr  5 12:54:12 2018	(r332065)
@@ -2478,6 +2478,7 @@ linux_ioctl_socket(struct thread *td, struct linux_ioc
 		printf("%s(): ioctl %d on %.*s\n", __func__,
 		    args->cmd & 0xffff, LINUX_IFNAMSIZ, lifname);
 #endif
+		memset(ifname, 0, sizeof(ifname));
 		ifp = ifname_linux_to_bsd(td, lifname, ifname);
 		if (ifp == NULL)
 			return (EINVAL);