HomeFreeBSD

MFC r315510

Description

MFC r315510

nanosleep: plug a kernel memory disclosure

nanosleep() updates rmtp on EINVAL. In that case, kern_nanosleep()
has not updated rmt, so sys_nanosleep() updates the user-space rmtp
by copying garbage from its stack frame. This is not only a kernel
memory disclosure, it's also not POSIX-compliant. Fix it to update
rmtp only on EINTR.

Security: possibly
Sponsored by: Dell EMC

Details

Provenance
vangyzenAuthored on
Parents
rS315656: Fix back-to-back runs of sys/netinet/fibs_test;slaac_on_nondefault_fib6
Branches
Unknown
Tags
Unknown