svn commit: r330356 - head/sys/compat/linux

[Eitan Adler]

Author: eadler
Date: Sat Mar  3 21:14:55 2018
New Revision: 330356
URL: https://svnweb.freebsd.org/changeset/base/330356

Log:
  sys/linux: Fix a few potential infoleaks in Linux IPC
  
  Submitted by:	Domagoj Stolfa <domagoj.stolfa at gmail.com>
  MFC After:	1 month

Modified:
  head/sys/compat/linux/linux_ipc.c

Modified: head/sys/compat/linux/linux_ipc.c
==============================================================================
--- head/sys/compat/linux/linux_ipc.c	Sat Mar  3 21:05:28 2018	(r330355)
+++ head/sys/compat/linux/linux_ipc.c	Sat Mar  3 21:14:55 2018	(r330356)
@@ -548,6 +548,9 @@ linux_semctl(struct thread *td, struct linux_semctl_ar
 	register_t rval;
 	int cmd, error;
 
+	memset(&linux_seminfo, 0, sizeof(linux_seminfo));
+	memset(&linux_semid64, 0, sizeof(linux_semid64));
+
 	switch (args->cmd & ~LINUX_IPC_64) {
 	case LINUX_IPC_RMID:
 		cmd = IPC_RMID;
@@ -702,12 +705,15 @@ linux_msgctl(struct thread *td, struct linux_msgctl_ar
 	struct l_msqid64_ds linux_msqid64;
 	struct msqid_ds bsd_msqid;
 
+	memset(&linux_msqid64, 0, sizeof(linux_msqid64));
+
 	bsd_cmd = args->cmd & ~LINUX_IPC_64;
 	switch (bsd_cmd) {
 	case LINUX_IPC_INFO:
 	case LINUX_MSG_INFO: {
 		struct l_msginfo linux_msginfo;
 
+		memset(&linux_msginfo, 0, sizeof(linux_msginfo));
 		/*
 		 * XXX MSG_INFO uses the same data structure but returns different
 		 * dynamic counters in msgpool, msgmap, and msgtql fields.
@@ -832,6 +838,10 @@ linux_shmctl(struct thread *td, struct linux_shmctl_ar
 	struct l_shm_info linux_shm_info;
 	struct shmid_ds bsd_shmid;
 	int error;
+
+	memset(&linux_shm_info, 0, sizeof(linux_shm_info));
+	memset(&linux_shmid64, 0, sizeof(linux_shmid64));
+	memset(&linux_shminfo64, 0, sizeof(linux_shminfo64));
 
 	switch (args->cmd & ~LINUX_IPC_64) {