svn commit: r301049 - in releng/9.3: . sys/compat/linux sys/conf sys/kern

[Gleb Smirnoff]

Author: glebius
Date: Tue May 31 16:55:37 2016
New Revision: 301049
URL: https://svnweb.freebsd.org/changeset/base/301049

Log:
  Fix kernel stack disclosure in Linux compatibility layer. [SA-16:20]
  Fix kernel stack disclosure in 4.3BSD compatibility layer. [SA-16:21]
  
  Security:	SA-16:20
  Security:	SA-16:21
  Approved by:	so

Modified:
  releng/9.3/UPDATING
  releng/9.3/sys/compat/linux/linux_ioctl.c
  releng/9.3/sys/compat/linux/linux_misc.c
  releng/9.3/sys/conf/newvers.sh
  releng/9.3/sys/kern/vfs_syscalls.c

Modified: releng/9.3/UPDATING
==============================================================================
--- releng/9.3/UPDATING	Tue May 31 16:35:03 2016	(r301048)
+++ releng/9.3/UPDATING	Tue May 31 16:55:37 2016	(r301049)
@@ -11,6 +11,16 @@ handbook:
 Items affecting the ports and packages system can be found in
 /usr/ports/UPDATING.  Please read that file before running portupgrade.
 
+20160531	p43	FreeBSD-SA-16:20.linux
+			FreeBSD-SA-16:21.43bsd
+			FreeBSD-SA-16:22.libarchive
+			FreeBSD-SA-16:23.libarchive
+
+	Fix kernel stack disclosure in Linux compatibility layer. [SA-16:20]
+	Fix kernel stack disclosure in 4.3BSD compatibility layer. [SA-16:21]
+	Fix directory traversal in cpio(1). [SA-16:22]
+	Fix buffer overflow in libarchive(3). [SA-16:23]
+
 20160517	p42	FreeBSD-SA-16:18.atkbd
 
 	Fix buffer overflow in keyboard driver. [SA-16:18]

Modified: releng/9.3/sys/compat/linux/linux_ioctl.c
==============================================================================
--- releng/9.3/sys/compat/linux/linux_ioctl.c	Tue May 31 16:35:03 2016	(r301048)
+++ releng/9.3/sys/compat/linux/linux_ioctl.c	Tue May 31 16:55:37 2016	(r301049)
@@ -911,6 +911,8 @@ linux_ioctl_termio(struct thread *td, st
 
 	case LINUX_TIOCGSERIAL: {
 		struct linux_serial_struct lss;
+
+		bzero(&lss, sizeof(lss));
 		lss.type = LINUX_PORT_16550A;
 		lss.flags = 0;
 		lss.close_delay = 0;

Modified: releng/9.3/sys/compat/linux/linux_misc.c
==============================================================================
--- releng/9.3/sys/compat/linux/linux_misc.c	Tue May 31 16:35:03 2016	(r301048)
+++ releng/9.3/sys/compat/linux/linux_misc.c	Tue May 31 16:55:37 2016	(r301049)
@@ -138,6 +138,7 @@ linux_sysinfo(struct thread *td, struct 
 	int i, j;
 	struct timespec ts;
 
+	bzero(&sysinfo, sizeof(sysinfo));
 	getnanouptime(&ts);
 	if (ts.tv_nsec != 0)
 		ts.tv_sec++;

Modified: releng/9.3/sys/conf/newvers.sh
==============================================================================
--- releng/9.3/sys/conf/newvers.sh	Tue May 31 16:35:03 2016	(r301048)
+++ releng/9.3/sys/conf/newvers.sh	Tue May 31 16:55:37 2016	(r301049)
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="9.3"
-BRANCH="RELEASE-p42"
+BRANCH="RELEASE-p43"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi

Modified: releng/9.3/sys/kern/vfs_syscalls.c
==============================================================================
--- releng/9.3/sys/kern/vfs_syscalls.c	Tue May 31 16:35:03 2016	(r301048)
+++ releng/9.3/sys/kern/vfs_syscalls.c	Tue May 31 16:55:37 2016	(r301049)
@@ -2326,6 +2326,7 @@ cvtstat(st, ost)
 	struct ostat *ost;
 {
 
+	bzero(ost, sizeof(*ost));
 	ost->st_dev = st->st_dev;
 	ost->st_ino = st->st_ino;
 	ost->st_mode = st->st_mode;