[src/netbsd-7]: src/sys Pull up following revision(s) (requested by maxv in t...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/4e7334c2f5d0
branches:  netbsd-7
changeset: 799162:4e7334c2f5d0
user:      martin <martin%NetBSD.org@localhost>
date:      Sun Mar 29 09:07:55 2015 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #650):
        sys/compat/netbsd32/netbsd32_exec_elf32.c: revision 1.39
        sys/kern/exec_elf.c: revision 1.71
        sys/compat/linux32/common/linux32_exec_elf32.c: revision 1.18
        sys/compat/linux/common/linux_exec_elf32.c: revision 1.92
        sys/compat/svr4_32/svr4_32_exec_elf32.c: revision 1.24
Zero-fill the ELF auxiliary vectors. Otherwise, on 64bit systems, the
padding between a_v and a_type contains kernel garbage, therefore
exposed to userland.
Original report by uebayasi@

diffstat:

 sys/compat/linux/common/linux_exec_elf32.c     |  6 ++++--
 sys/compat/linux32/common/linux32_exec_elf32.c |  6 ++++--
 sys/compat/netbsd32/netbsd32_exec_elf32.c      |  6 ++++--
 sys/compat/svr4_32/svr4_32_exec_elf32.c        |  8 ++++++--
 sys/kern/exec_elf.c                            |  6 ++++--
 5 files changed, 22 insertions(+), 10 deletions(-)

diffs (144 lines):

diff -r f7ad0cc4828f -r 4e7334c2f5d0 sys/compat/linux/common/linux_exec_elf32.c
--- a/sys/compat/linux/common/linux_exec_elf32.c        Sun Mar 29 08:48:25 2015 +0000
+++ b/sys/compat/linux/common/linux_exec_elf32.c        Sun Mar 29 09:07:55 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: linux_exec_elf32.c,v 1.91 2014/04/15 17:29:00 maxv Exp $       */
+/*     $NetBSD: linux_exec_elf32.c,v 1.91.2.1 2015/03/29 09:07:55 martin Exp $ */
 
 /*-
  * Copyright (c) 1995, 1998, 2000, 2001 The NetBSD Foundation, Inc.
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: linux_exec_elf32.c,v 1.91 2014/04/15 17:29:00 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_exec_elf32.c,v 1.91.2.1 2015/03/29 09:07:55 martin Exp $");
 
 #ifndef ELFSIZE
 /* XXX should die */
@@ -391,6 +391,8 @@
 
        a = ai;
 
+       memset(ai, 0, sizeof(ai));
+
        /*
         * Push extra arguments used by glibc on the stack.
         */
diff -r f7ad0cc4828f -r 4e7334c2f5d0 sys/compat/linux32/common/linux32_exec_elf32.c
--- a/sys/compat/linux32/common/linux32_exec_elf32.c    Sun Mar 29 08:48:25 2015 +0000
+++ b/sys/compat/linux32/common/linux32_exec_elf32.c    Sun Mar 29 09:07:55 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: linux32_exec_elf32.c,v 1.17 2014/02/23 16:07:40 njoly Exp $ */
+/*     $NetBSD: linux32_exec_elf32.c,v 1.17.4.1 2015/03/29 09:07:55 martin Exp $ */
 
 /*-                     
  * Copyright (c) 1995, 1998, 2000, 2001,2006 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: linux32_exec_elf32.c,v 1.17 2014/02/23 16:07:40 njoly Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux32_exec_elf32.c,v 1.17.4.1 2015/03/29 09:07:55 martin Exp $");
 
 #define        ELFSIZE         32
 
@@ -119,6 +119,8 @@
 
        a = ai;
 
+       memset(ai, 0, sizeof(ai));
+
        /*
         * Push extra arguments on the stack needed by dynamically
         * linked binaries and static binaries as well.
diff -r f7ad0cc4828f -r 4e7334c2f5d0 sys/compat/netbsd32/netbsd32_exec_elf32.c
--- a/sys/compat/netbsd32/netbsd32_exec_elf32.c Sun Mar 29 08:48:25 2015 +0000
+++ b/sys/compat/netbsd32/netbsd32_exec_elf32.c Sun Mar 29 09:07:55 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: netbsd32_exec_elf32.c,v 1.37 2014/07/25 16:23:13 maxv Exp $    */
+/*     $NetBSD: netbsd32_exec_elf32.c,v 1.37.2.1 2015/03/29 09:07:55 martin Exp $      */
 /*     from: NetBSD: exec_aout.c,v 1.15 1996/09/26 23:34:46 cgd Exp */
 
 /*
@@ -57,7 +57,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: netbsd32_exec_elf32.c,v 1.37 2014/07/25 16:23:13 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: netbsd32_exec_elf32.c,v 1.37.2.1 2015/03/29 09:07:55 martin Exp $");
 
 #define        ELFSIZE         32
 
@@ -143,6 +143,8 @@
 
        a = ai;
 
+       memset(ai, 0, sizeof(ai));
+
        /*
         * Push extra arguments on the stack needed by dynamically
         * linked binaries
diff -r f7ad0cc4828f -r 4e7334c2f5d0 sys/compat/svr4_32/svr4_32_exec_elf32.c
--- a/sys/compat/svr4_32/svr4_32_exec_elf32.c   Sun Mar 29 08:48:25 2015 +0000
+++ b/sys/compat/svr4_32/svr4_32_exec_elf32.c   Sun Mar 29 09:07:55 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: svr4_32_exec_elf32.c,v 1.23 2014/04/09 11:40:03 maxv Exp $      */
+/*     $NetBSD: svr4_32_exec_elf32.c,v 1.23.2.1 2015/03/29 09:07:55 martin Exp $        */
 
 /*-
  * Copyright (c) 1994 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: svr4_32_exec_elf32.c,v 1.23 2014/04/09 11:40:03 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: svr4_32_exec_elf32.c,v 1.23.2.1 2015/03/29 09:07:55 martin Exp $");
 
 #define        ELFSIZE         32                              /* XXX should die */
 
@@ -81,6 +81,8 @@
 
        a = ai;
 
+       memset(ai, 0, sizeof(ai));
+
        /*
         * Push extra arguments on the stack needed by dynamically
         * linked binaries
@@ -200,6 +202,8 @@
 
        a = ai;
 
+       memset(ai, 0, sizeof(ai));
+
        /*
         * Push extra arguments on the stack needed by dynamically
         * linked binaries
diff -r f7ad0cc4828f -r 4e7334c2f5d0 sys/kern/exec_elf.c
--- a/sys/kern/exec_elf.c       Sun Mar 29 08:48:25 2015 +0000
+++ b/sys/kern/exec_elf.c       Sun Mar 29 09:07:55 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: exec_elf.c,v 1.69.2.1 2014/08/18 07:37:04 martin Exp $ */
+/*     $NetBSD: exec_elf.c,v 1.69.2.2 2015/03/29 09:07:55 martin Exp $ */
 
 /*-
  * Copyright (c) 1994, 2000, 2005 The NetBSD Foundation, Inc.
@@ -57,7 +57,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(1, "$NetBSD: exec_elf.c,v 1.69.2.1 2014/08/18 07:37:04 martin Exp $");
+__KERNEL_RCSID(1, "$NetBSD: exec_elf.c,v 1.69.2.2 2015/03/29 09:07:55 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_pax.h"
@@ -178,6 +178,8 @@
        a = ai;
        execname = NULL;
 
+       memset(ai, 0, sizeof(ai));
+
        /*
         * Push extra arguments on the stack needed by dynamically
         * linked binaries