From 86a921b1ab9596bf698d84429aab86a4be596a80 Mon Sep 17 00:00:00 2001
From: glebius <glebius@FreeBSD.org>
Date: Tue, 31 May 2016 16:55:50 +0000
Subject: Fix kernel stack disclosure in Linux compatibility layer. [SA-16:20]
 Fix kernel stack disclosure in 4.3BSD compatibility layer. [SA-16:21]

Security:	SA-16:20
Security:	SA-16:21
Approved by:	so
---
 UPDATING                       | 9 +++++++++
 sys/compat/linux/linux_ioctl.c | 2 ++
 sys/compat/linux/linux_misc.c  | 1 +
 sys/conf/newvers.sh            | 2 +-
 sys/kern/vfs_syscalls.c        | 1 +
 5 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/UPDATING b/UPDATING
index 2a1249e..19a43ca 100644
--- a/UPDATING
+++ b/UPDATING
@@ -16,6 +16,15 @@ from older versions of FreeBSD, try WITHOUT_CLANG to bootstrap to the tip of
 stable/10, and then rebuild without this option. The bootstrap process from
 older version of current is a bit fragile.
 
+20160531	p4	FreeBSD-SA-16:20.linux
+			FreeBSD-SA-16:21.43bsd
+			FreeBSD-SA-16:22.libarchive
+
+	Fix kernel stack disclosure in Linux compatibility layer. [SA-16:20]
+	Fix kernel stack disclosure in 4.3BSD compatibility layer. [SA-16:21]
+	Fix directory traversal in cpio(1). [SA-16:22]
+
+
 20160517	p3	FreeBSD-SA-16:18.atkbd
 			FreeBSD-SA-16:19.sendmsg
 
diff --git a/sys/compat/linux/linux_ioctl.c b/sys/compat/linux/linux_ioctl.c
index 8858e2f..2002379 100644
--- a/sys/compat/linux/linux_ioctl.c
+++ b/sys/compat/linux/linux_ioctl.c
@@ -915,6 +915,8 @@ linux_ioctl_termio(struct thread *td, struct linux_ioctl_args *args)
 
 	case LINUX_TIOCGSERIAL: {
 		struct linux_serial_struct lss;
+
+		bzero(&lss, sizeof(lss));
 		lss.type = LINUX_PORT_16550A;
 		lss.flags = 0;
 		lss.close_delay = 0;
diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c
index 538b9dc..abc489c 100644
--- a/sys/compat/linux/linux_misc.c
+++ b/sys/compat/linux/linux_misc.c
@@ -150,6 +150,7 @@ linux_sysinfo(struct thread *td, struct linux_sysinfo_args *args)
 	int i, j;
 	struct timespec ts;
 
+	bzero(&sysinfo, sizeof(sysinfo));
 	getnanouptime(&ts);
 	if (ts.tv_nsec != 0)
 		ts.tv_sec++;
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 142bd8a..68ba3ef 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="10.3"
-BRANCH="RELEASE-p3"
+BRANCH="RELEASE-p4"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 4dafe75..7979e37 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -2197,6 +2197,7 @@ cvtstat(st, ost)
 	struct ostat *ost;
 {
 
+	bzero(ost, sizeof(*ost));
 	ost->st_dev = st->st_dev;
 	ost->st_ino = st->st_ino;
 	ost->st_mode = st->st_mode;
-- 
cgit v1.1