diff options
| author | kib <kib@FreeBSD.org> | 2011-02-05 15:10:27 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2011-02-05 15:10:27 +0000 |
| commit | 7bb770f50569c30360fa8ab90ee3a62664f26a17 (patch) | |
| tree | e9d326ccc72870724643bb78427f2751a20d4328 /sys/amd64/amd64/machdep.c | |
| parent | ff6aee65ced361bd15132be42d4fc4424670f651 (diff) | |
| download | FreeBSD-src-7bb770f50569c30360fa8ab90ee3a62664f26a17.zip FreeBSD-src-7bb770f50569c30360fa8ab90ee3a62664f26a17.tar.gz | |
Clear the padding when returning context to the usermode, for
MI ucontext_t and x86 MD parts.
Kernel allocates the structures on the stack, and not clearing
reserved fields and paddings causes leakage.
Noted and discussed with: bde
MFC after: 2 weeks
Diffstat (limited to 'sys/amd64/amd64/machdep.c')
| -rw-r--r-- | sys/amd64/amd64/machdep.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sys/amd64/amd64/machdep.c b/sys/amd64/amd64/machdep.c index a6068b5..d350aa6 100644 --- a/sys/amd64/amd64/machdep.c +++ b/sys/amd64/amd64/machdep.c @@ -331,6 +331,9 @@ sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask) fpstate_drop(td); sf.sf_uc.uc_mcontext.mc_fsbase = pcb->pcb_fsbase; sf.sf_uc.uc_mcontext.mc_gsbase = pcb->pcb_gsbase; + bzero(sf.sf_uc.uc_mcontext.mc_spare, + sizeof(sf.sf_uc.uc_mcontext.mc_spare)); + bzero(sf.sf_uc.__spare__, sizeof(sf.sf_uc.__spare__)); /* Allocate space for the signal handler context. */ if ((td->td_pflags & TDP_ALTSTACK) != 0 && !oonstack && @@ -352,6 +355,7 @@ sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask) /* Build the argument list for the signal handler. */ regs->tf_rdi = sig; /* arg 1 in %rdi */ regs->tf_rdx = (register_t)&sfp->sf_uc; /* arg 3 in %rdx */ + bzero(&sf.sf_si, sizeof(sf.sf_si)); if (SIGISMEMBER(psp->ps_siginfo, sig)) { /* Signal handler installed with SA_SIGINFO. */ regs->tf_rsi = (register_t)&sfp->sf_si; /* arg 2 in %rsi */ @@ -2043,6 +2047,7 @@ get_mcontext(struct thread *td, mcontext_t *mcp, int flags) get_fpcontext(td, mcp); mcp->mc_fsbase = pcb->pcb_fsbase; mcp->mc_gsbase = pcb->pcb_gsbase; + bzero(mcp->mc_spare, sizeof(mcp->mc_spare)); return (0); } |
