Author: nyan
Date: Mon Feb 7 07:51:31 2011
New Revision: 218390
URL: http://svn.freebsd.org/changeset/base/218390
Log:
MFi386: revision 218327
Clear the padding when returning context to the usermode, for
MI ucontext_t and x86 MD parts.
Kernel allocates the structures on the stack, and not clearing
reserved fields and paddings causes leakage.
Modified:
head/sys/pc98/pc98/machdep.c
Modified: head/sys/pc98/pc98/machdep.c
==============================================================================
--- head/sys/pc98/pc98/machdep.c Mon Feb 7 07:39:09 2011
(r218389)
+++ head/sys/pc98/pc98/machdep.c Mon Feb 7 07:51:31 2011
(r218390)
@@ -311,12 +311,14 @@ osendsig(sig_t catcher, ksiginfo_t *ksi,
/* Build the argument list for the signal handler. */
sf.sf_signum = sig;
sf.sf_scp = (register_t)&fp->sf_siginfo.si_sc;
+ bzero(&sf.sf_siginfo, sizeof(sf.sf_siginfo));
if (SIGISMEMBER(psp->ps_siginfo, sig)) {
/* Signal handler installed with SA_SIGINFO. */
sf.sf_arg2 = (register_t)&fp->sf_siginfo;
sf.sf_siginfo.si_signo = sig;
sf.sf_siginfo.si_code = ksi->ksi_code;
sf.sf_ahu.sf_action = (__osiginfohandler_t *)catcher;
+ sf.sf_addr = 0;
} else {
/* Old FreeBSD-style arguments. */
sf.sf_arg2 = ksi->ksi_code;
@@ -430,6 +432,11 @@ freebsd4_sendsig(sig_t catcher, ksiginfo
sf.sf_uc.uc_mcontext.mc_onstack = (oonstack) ? 1 : 0;
sf.sf_uc.uc_mcontext.mc_gs = rgs();
bcopy(regs, &sf.sf_uc.uc_mcontext.mc_fs, sizeof(*regs));
+ bzero(sf.sf_uc.uc_mcontext.mc_fpregs,
+ sizeof(sf.sf_uc.uc_mcontext.mc_fpregs));
+ bzero(sf.sf_uc.uc_mcontext.__spare__,
+ sizeof(sf.sf_uc.uc_mcontext.__spare__));
+ bzero(sf.sf_uc.__spare__, sizeof(sf.sf_uc.__spare__));
/* Allocate space for the signal handler context. */
if ((td->td_pflags & TDP_ALTSTACK) != 0 && !oonstack &&
@@ -449,6 +456,7 @@ freebsd4_sendsig(sig_t catcher, ksiginfo
/* Build the argument list for the signal handler. */
sf.sf_signum = sig;
sf.sf_ucontext = (register_t)&sfp->sf_uc;
+ bzero(&sf.sf_si, sizeof(sf.sf_si));
if (SIGISMEMBER(psp->ps_siginfo, sig)) {
/* Signal handler installed with SA_SIGINFO. */
sf.sf_siginfo = (register_t)&sfp->sf_si;
@@ -575,6 +583,11 @@ sendsig(sig_t catcher, ksiginfo_t *ksi,
sdp = &td->td_pcb->pcb_gsd;
sf.sf_uc.uc_mcontext.mc_gsbase = sdp->sd_hibase << 24 |
sdp->sd_lobase;
+ bzero(sf.sf_uc.uc_mcontext.mc_spare1,
+ sizeof(sf.sf_uc.uc_mcontext.mc_spare1));
+ bzero(sf.sf_uc.uc_mcontext.mc_spare2,
+ sizeof(sf.sf_uc.uc_mcontext.mc_spare2));
+ bzero(sf.sf_uc.__spare__, sizeof(sf.sf_uc.__spare__));
/* Allocate space for the signal handler context. */
if ((td->td_pflags & TDP_ALTSTACK) != 0 && !oonstack &&
@@ -596,6 +609,7 @@ sendsig(sig_t catcher, ksiginfo_t *ksi,
/* Build the argument list for the signal handler. */
sf.sf_signum = sig;
sf.sf_ucontext = (register_t)&sfp->sf_uc;
+ bzero(&sf.sf_si, sizeof(sf.sf_si));
if (SIGISMEMBER(psp->ps_siginfo, sig)) {
/* Signal handler installed with SA_SIGINFO. */
sf.sf_siginfo = (register_t)&sfp->sf_si;
@@ -2622,7 +2636,8 @@ get_mcontext(struct thread *td, mcontext
mcp->mc_fsbase = sdp->sd_hibase << 24 | sdp->sd_lobase;
sdp = &td->td_pcb->pcb_gsd;
mcp->mc_gsbase = sdp->sd_hibase << 24 | sdp->sd_lobase;
-
+ bzero(mcp->mc_spare1, sizeof(mcp->mc_spare1));
+ bzero(mcp->mc_spare2, sizeof(mcp->mc_spare2));
return (0);
}
@@ -2671,6 +2686,7 @@ get_fpcontext(struct thread *td, mcontex
#ifndef DEV_NPX
mcp->mc_fpformat = _MC_FPFMT_NODEV;
mcp->mc_ownedfp = _MC_FPOWNED_NONE;
+ bzero(mcp->mc_fpstate, sizeof(mcp->mc_fpstate));
#else
mcp->mc_ownedfp = npxgetregs(td);
bcopy(&td->td_pcb->pcb_user_save, &mcp->mc_fpstate,
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
