DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2549

ttyinfo prints uninitialized stack rusage when the foreground LWP has no thread

Summary

ttyinfo declares struct rusage ru on stack uninitialized and only fills it via calcru_proc when lp->lwp_thread non-NULL. When foreground process first LWP caught mid-teardown (lwp_thread==NULL) guard skips calcru_proc but routine still formats ru.ru_utime and ru.ru_stime to tty via ttyprintf leaking up to 16 bytes uninitialized kernel stack to whoever triggered status display (^T VSTATUS TIOCSTAT ioctl). lp->lwp_thread set NULL during LWP teardown kern_exit.c:907.

Discussion (0)

No comments yet.