Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master

* freebsd/12-stable/master: MFC r343784: Avoid leaking fp references when truncating SCM_RIGHTS control messages. MFC r343780: amd64: clear callee-preserved registers on syscall exit. Signed-off-by: Oliver Pinter <[email protected]>
HardenedBSD · Feb 5, 2019 · ef13175 · ef13175
2 parents b574197 + 0526a0c
commit ef13175
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/sys/amd64/amd64/exception.S b/sys/amd64/amd64/exception.S
@@ -521,12 +521,14 @@ fast_syscall_common:
 	movq	TF_RFLAGS(%rsp),%r11	/* original %rflags */
 	movq	TF_RIP(%rsp),%rcx	/* original %rip */
 	movq	TF_RSP(%rsp),%rsp	/* user stack pointer */
+	xorl	%r8d,%r8d		/* zero the rest of GPRs */
+	xorl	%r10d,%r10d
 	cmpq	$~0,PCPU(UCR3)
 	je	2f
 	movq	PCPU(UCR3),%r9
 	movq	%r9,%cr3
-	xorl	%r9d,%r9d
-2:	swapgs
+2:	xorl	%r9d,%r9d
+	swapgs
 	sysretq
 
 3:	/* AST scheduled. */

diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
@@ -1607,8 +1607,10 @@ m_dispose_extcontrolm(struct mbuf *m)
 					fd = *fds++;
 					error = fget(td, fd, &cap_no_rights,
 					    &fp);
-					if (error == 0)
+					if (error == 0) {
 						fdclose(td, fp, fd);
+						fdrop(fp, td);
+					}
 				}
 			}
 			clen -= datalen;