DragonFlyBSD Kernel Audit
DF-0027 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -1023,6 +1023,20 @@
 	}
 
 	/*
+	 * Initialize all output parameters up front so that early-success
+	 * return paths that do not reap a child (WNOHANG with no waitable
+	 * child, or WCONTINUED which only fills status/info) cannot leak
+	 * uninitialized kernel stack memory back to userland via the
+	 * sys_wait4/sys_wait6 copyouts.
+	 */
+	if (status)
+		*status = 0;
+	if (wrusage)
+		bzero(wrusage, sizeof(*wrusage));
+	if (info)
+		bzero(info, sizeof(*info));
+
+	/*
 	 * Protect the q->p_children list
 	 */
 	lwkt_gettoken(&q->p_token);