HomeFreeBSD

MFC r315510

Description

MFC r315510

nanosleep: plug a kernel memory disclosure

nanosleep() updates rmtp on EINVAL. In that case, kern_nanosleep()
has not updated rmt, so sys_nanosleep() updates the user-space rmtp
by copying garbage from its stack frame. This is not only a kernel
memory disclosure, it's also not POSIX-compliant. Fix it to update
rmtp only on EINTR.

Security: possibly
Sponsored by: Dell EMC

Details

Provenance
vangyzenAuthored on
Parents
rS315657: MFC r315510
Branches
Unknown
Tags
Unknown