svn commit: r343286 - head/sys/fs/nfsserver

[Mark Johnston]

Author: markj
Date: Mon Jan 21 23:54:33 2019
New Revision: 343286
URL: https://svnweb.freebsd.org/changeset/base/343286

Log:
  nfs: Zero the buffers exported by NFSSVC_DUMPCLIENTS and DUMPLOCKS.
  
  Note that these interfaces are available only to root.
  
  admbugs:	765
  Reported by:	Vlad Tsyrklevich <vlad at tsyrklevich.net>
  Reviewed by:	rmacklem
  MFC after:	1 day
  Security:	Kernel memory disclosure
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sys/fs/nfsserver/nfs_nfsdport.c

Modified: head/sys/fs/nfsserver/nfs_nfsdport.c
==============================================================================
--- head/sys/fs/nfsserver/nfs_nfsdport.c	Mon Jan 21 20:58:33 2019	(r343285)
+++ head/sys/fs/nfsserver/nfs_nfsdport.c	Mon Jan 21 23:54:33 2019	(r343286)
@@ -3614,8 +3614,7 @@ nfssvc_srvcall(struct thread *p, struct nfssvc_args *u
 			error = EPERM;
 		if (!error) {
 		    len = sizeof (struct nfsd_dumpclients) * dumplist.ndl_size;
-		    dumpclients = (struct nfsd_dumpclients *)malloc(len,
-			M_TEMP, M_WAITOK);
+		    dumpclients = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
 		    nfsrv_dumpclients(dumpclients, dumplist.ndl_size);
 		    error = copyout(dumpclients,
 			CAST_USER_ADDR_T(dumplist.ndl_list), len);
@@ -3633,8 +3632,7 @@ nfssvc_srvcall(struct thread *p, struct nfssvc_args *u
 		if (!error) {
 			len = sizeof (struct nfsd_dumplocks) *
 				dumplocklist.ndllck_size;
-			dumplocks = (struct nfsd_dumplocks *)malloc(len,
-				M_TEMP, M_WAITOK);
+			dumplocks = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
 			nfsrv_dumplocks(nd.ni_vp, dumplocks,
 			    dumplocklist.ndllck_size, p);
 			vput(nd.ni_vp);