CVS commit: [netbsd-8] src/sys/ufs/ufs

[Martin Husemann]

Module Name:    src
Committed By:   martin
Date:           Mon Mar  2 08:07:22 UTC 2020

Modified Files:
        src/sys/ufs/ufs [netbsd-8]: dir.h ufs_lookup.c

Log Message:
Additionally pull up the following revisions, to fix build fallout from
ticket #1511:

        src/sys/ufs/ufs/dir.h                   1.26
        sys/ufs/ufs/ufs_lookup.c                1.149

Zero out all the dirent padding not just one byte, to avoid kernel memory
disclosure (from https://svnweb.freebsd.org/base?view=revision&revision=347066)


To generate a diff of this commit:
cvs rdiff -u -r1.25 -r1.25.10.1 src/sys/ufs/ufs/dir.h
cvs rdiff -u -r1.146 -r1.146.6.1 src/sys/ufs/ufs/ufs_lookup.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/ufs/ufs/dir.h
diff -u src/sys/ufs/ufs/dir.h:1.25 src/sys/ufs/ufs/dir.h:1.25.10.1
--- src/sys/ufs/ufs/dir.h:1.25	Tue Sep  1 06:16:03 2015
+++ src/sys/ufs/ufs/dir.h	Mon Mar  2 08:07:22 2020
@@ -1,4 +1,4 @@
-/*	$NetBSD: dir.h,v 1.25 2015/09/01 06:16:03 dholland Exp $	*/
+/*	$NetBSD: dir.h,v 1.25.10.1 2020/03/02 08:07:22 martin Exp $	*/
 
 /*
  * Copyright (c) 1982, 1986, 1989, 1993
@@ -111,8 +111,11 @@ struct	direct {
  * without the d_name field, plus enough space for the name with a terminating
  * null byte (dp->d_namlen+1), rounded up to a 4 byte boundary.
  */
+#define DIR_ROUNDUP	4
+#define UFS_NAMEROUNDUP(namlen)	(((namlen) + DIR_ROUNDUP) & ~(DIR_ROUNDUP - 1))
+#define UFS_NAMEPAD(namlen)	(DIR_ROUNDUP - ((namlen) & (DIR_ROUNDUP - 1)))
 #define	UFS_DIRECTSIZ(namlen) \
-	((sizeof(struct direct) - (FFS_MAXNAMLEN+1)) + (((namlen)+1 + 3) &~ 3))
+	((sizeof(struct direct) - (FFS_MAXNAMLEN+1)) + UFS_NAMEROUNDUP(namlen))
 
 #if (BYTE_ORDER == LITTLE_ENDIAN)
 #define UFS_DIRSIZ(oldfmt, dp, needswap)	\

Index: src/sys/ufs/ufs/ufs_lookup.c
diff -u src/sys/ufs/ufs/ufs_lookup.c:1.146 src/sys/ufs/ufs/ufs_lookup.c:1.146.6.1
--- src/sys/ufs/ufs/ufs_lookup.c:1.146	Thu Mar 30 09:11:45 2017
+++ src/sys/ufs/ufs/ufs_lookup.c	Mon Mar  2 08:07:22 2020
@@ -1,4 +1,4 @@
-/*	$NetBSD: ufs_lookup.c,v 1.146 2017/03/30 09:11:45 hannken Exp $	*/
+/*	$NetBSD: ufs_lookup.c,v 1.146.6.1 2020/03/02 08:07:22 martin Exp $	*/
 
 /*
  * Copyright (c) 1989, 1993
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ufs_lookup.c,v 1.146 2017/03/30 09:11:45 hannken Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ufs_lookup.c,v 1.146.6.1 2020/03/02 08:07:22 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_ffs.h"
@@ -793,10 +793,15 @@ void
 ufs_makedirentry(struct inode *ip, struct componentname *cnp,
     struct direct *newdirp)
 {
+	size_t namelen = cnp->cn_namelen;
+
 	newdirp->d_ino = ip->i_number;
-	newdirp->d_namlen = cnp->cn_namelen;
-	memcpy(newdirp->d_name, cnp->cn_nameptr, (size_t)cnp->cn_namelen);
-	newdirp->d_name[cnp->cn_namelen] = '\0';
+	newdirp->d_namlen = namelen;
+	memcpy(newdirp->d_name, cnp->cn_nameptr, namelen);
+
+	/* Zero out padding */
+	memset(&newdirp->d_name[namelen], 0, UFS_NAMEPAD(namelen));
+
 	if (FSFMT(ITOV(ip)))
 		newdirp->d_type = 0;
 	else