Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 27 Nov 2018 16:55:25 +0000 (UTC)
From:      Mark Johnston <markj@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r341076 - stable/11/sys/kern
Message-ID:  <201811271655.wARGtP0s045336@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: markj
Date: Tue Nov 27 16:55:24 2018
New Revision: 341076
URL: https://svnweb.freebsd.org/changeset/base/341076

Log:
  MFC r340899:
  Plug some kernel memory disclosures via kevent(2).

Modified:
  stable/11/sys/kern/kern_event.c
  stable/11/sys/kern/vfs_aio.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/kern/kern_event.c
==============================================================================
--- stable/11/sys/kern/kern_event.c	Tue Nov 27 16:54:23 2018	(r341075)
+++ stable/11/sys/kern/kern_event.c	Tue Nov 27 16:55:24 2018	(r341076)
@@ -498,8 +498,9 @@ knote_fork(struct knlist *list, int pid)
 
 	if (list == NULL)
 		return;
-	list->kl_lock(list->kl_lockarg);
 
+	memset(&kev, 0, sizeof(kev));
+	list->kl_lock(list->kl_lockarg);
 	SLIST_FOREACH(kn, &list->kl_list, kn_selnext) {
 		kq = kn->kn_kq;
 		KQ_LOCK(kq);

Modified: stable/11/sys/kern/vfs_aio.c
==============================================================================
--- stable/11/sys/kern/vfs_aio.c	Tue Nov 27 16:54:23 2018	(r341075)
+++ stable/11/sys/kern/vfs_aio.c	Tue Nov 27 16:55:24 2018	(r341076)
@@ -1594,6 +1594,7 @@ aio_aqueue(struct thread *td, struct aiocb *ujob, stru
 		goto aqueue_fail;
 	}
 	kqfd = job->uaiocb.aio_sigevent.sigev_notify_kqueue;
+	memset(&kev, 0, sizeof(kev));
 	kev.ident = (uintptr_t)job->ujob;
 	kev.filter = EVFILT_AIO;
 	kev.flags = EV_ADD | EV_ENABLE | EV_FLAG1 | evflags;
@@ -2163,6 +2164,7 @@ kern_lio_listio(struct thread *td, int mode, struct ai
 		bcopy(sig, &lj->lioj_signal, sizeof(lj->lioj_signal));
 		if (lj->lioj_signal.sigev_notify == SIGEV_KEVENT) {
 			/* Assume only new style KEVENT */
+			memset(&kev, 0, sizeof(kev));
 			kev.filter = EVFILT_LIO;
 			kev.flags = EV_ADD | EV_ENABLE | EV_FLAG1;
 			kev.ident = (uintptr_t)uacb_list; /* something unique */



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201811271655.wARGtP0s045336>