NetBSD Problem Report #60754

From www@netbsd.org  Sun Sep 20 12:27:14 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 05FE21A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 20 Sep 2026 12:27:13 +0000 (UTC)
Message-Id: <20260920122713.182BC1A923C@mollari.NetBSD.org>
Date: Sun, 20 Sep 2026 12:27:13 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: kern: potential syscall argument package stack garbage
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60754
>Category:       kern
>Synopsis:       kern: potential syscall argument package stack garbage
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Sep 20 12:30:01 +0000 2026
>Closed-Date:    
>Last-Modified:  Fri Oct 02 03:27:31 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
The NetBSD Syscaller, Inc.
>Environment:
>Description:

	Various functions -- mostly in compat_* -- are defined by
	creating syscall argument packages and invoking the syscall
	entry point:

		struct sys_foo_args ua;

		SCARG(&ua, x) = 42;
		SCARG(&ua, y) = pqr;

		sys_foo(l, &ua, retval);

	There have been some bugs with missing parameters that instead
	receive stack garbage.  We should systematically zero these
	argument packages.

>How-To-Repeat:

	code inspection

>Fix:

	memset(&ua, 0, sizeof(ua));

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60754 CVS commit: src/sys
Date: Sun, 20 Sep 2026 13:45:01 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:45:00 UTC 2026

 Modified Files:
 	src/sys/arch/arm/arm32: netbsd32_machdep_13.c netbsd32_machdep_16.c
 	src/sys/arch/mips/mips: netbsd32_machdep_13.c netbsd32_machdep_16.c
 	src/sys/compat/common: kern_ipc_10.c kern_time_50.c uipc_syscalls_43.c
 	    vfs_syscalls_43.c vm_12.c vm_43.c
 	src/sys/compat/netbsd32: netbsd32_compat_09.c netbsd32_compat_10_sysv.c
 	    netbsd32_compat_12.c netbsd32_compat_20.c netbsd32_compat_30.c
 	    netbsd32_compat_40.c netbsd32_compat_43.c netbsd32_compat_50.c
 	    netbsd32_compat_50_quota.c netbsd32_epoll.c netbsd32_fs.c
 	    netbsd32_ipc.c netbsd32_lwp.c netbsd32_mqueue.c netbsd32_netbsd.c
 	    netbsd32_sem.c netbsd32_signal.c netbsd32_time.c netbsd32_vm.c

 Log Message:
 compat: Zero out syscall argument packages on stack.

 PR kern/60754: potential syscall argument package stack garbage


 To generate a diff of this commit:
 cvs rdiff -u -r1.5 -r1.6 src/sys/arch/arm/arm32/netbsd32_machdep_13.c \
     src/sys/arch/arm/arm32/netbsd32_machdep_16.c
 cvs rdiff -u -r1.4 -r1.5 src/sys/arch/mips/mips/netbsd32_machdep_13.c
 cvs rdiff -u -r1.8 -r1.9 src/sys/arch/mips/mips/netbsd32_machdep_16.c
 cvs rdiff -u -r1.26 -r1.27 src/sys/compat/common/kern_ipc_10.c
 cvs rdiff -u -r1.38 -r1.39 src/sys/compat/common/kern_time_50.c
 cvs rdiff -u -r1.52 -r1.53 src/sys/compat/common/uipc_syscalls_43.c
 cvs rdiff -u -r1.68 -r1.69 src/sys/compat/common/vfs_syscalls_43.c
 cvs rdiff -u -r1.21 -r1.22 src/sys/compat/common/vm_12.c \
     src/sys/compat/common/vm_43.c
 cvs rdiff -u -r1.20 -r1.21 src/sys/compat/netbsd32/netbsd32_compat_09.c
 cvs rdiff -u -r1.3 -r1.4 src/sys/compat/netbsd32/netbsd32_compat_10_sysv.c \
     src/sys/compat/netbsd32/netbsd32_vm.c
 cvs rdiff -u -r1.36 -r1.37 src/sys/compat/netbsd32/netbsd32_compat_12.c \
     src/sys/compat/netbsd32/netbsd32_compat_30.c
 cvs rdiff -u -r1.42 -r1.43 src/sys/compat/netbsd32/netbsd32_compat_20.c
 cvs rdiff -u -r1.4 -r1.5 src/sys/compat/netbsd32/netbsd32_compat_40.c
 cvs rdiff -u -r1.66 -r1.67 src/sys/compat/netbsd32/netbsd32_compat_43.c
 cvs rdiff -u -r1.56 -r1.57 src/sys/compat/netbsd32/netbsd32_compat_50.c
 cvs rdiff -u -r1.2 -r1.3 src/sys/compat/netbsd32/netbsd32_compat_50_quota.c
 cvs rdiff -u -r1.5 -r1.6 src/sys/compat/netbsd32/netbsd32_epoll.c
 cvs rdiff -u -r1.95 -r1.96 src/sys/compat/netbsd32/netbsd32_fs.c
 cvs rdiff -u -r1.24 -r1.25 src/sys/compat/netbsd32/netbsd32_ipc.c
 cvs rdiff -u -r1.23 -r1.24 src/sys/compat/netbsd32/netbsd32_lwp.c
 cvs rdiff -u -r1.7 -r1.8 src/sys/compat/netbsd32/netbsd32_mqueue.c
 cvs rdiff -u -r1.237 -r1.238 src/sys/compat/netbsd32/netbsd32_netbsd.c
 cvs rdiff -u -r1.12 -r1.13 src/sys/compat/netbsd32/netbsd32_sem.c
 cvs rdiff -u -r1.55 -r1.56 src/sys/compat/netbsd32/netbsd32_signal.c
 cvs rdiff -u -r1.58 -r1.59 src/sys/compat/netbsd32/netbsd32_time.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60754 CVS commit: src/sys/compat/freebsd
Date: Sun, 20 Sep 2026 13:45:28 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:45:28 UTC 2026

 Modified Files:
 	src/sys/compat/freebsd: freebsd_ipc.c freebsd_misc.c

 Log Message:
 compat_freebsd: Zero out syscall argument packages on stack.

 PR kern/60754: potential syscall argument package stack garbage


 To generate a diff of this commit:
 cvs rdiff -u -r1.17 -r1.18 src/sys/compat/freebsd/freebsd_ipc.c
 cvs rdiff -u -r1.35 -r1.36 src/sys/compat/freebsd/freebsd_misc.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60754 CVS commit: src/sys/compat
Date: Sun, 20 Sep 2026 13:46:08 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:46:08 UTC 2026

 Modified Files:
 	src/sys/compat/sunos: sunos_ioctl.c sunos_misc.c
 	src/sys/compat/sunos32: sunos32_ioctl.c sunos32_misc.c

 Log Message:
 compat_sunos: Zero out syscall argument packages on stack.

 PR kern/60754: potential syscall argument package stack garbage


 To generate a diff of this commit:
 cvs rdiff -u -r1.71 -r1.72 src/sys/compat/sunos/sunos_ioctl.c
 cvs rdiff -u -r1.177 -r1.178 src/sys/compat/sunos/sunos_misc.c
 cvs rdiff -u -r1.36 -r1.37 src/sys/compat/sunos32/sunos32_ioctl.c
 cvs rdiff -u -r1.86 -r1.87 src/sys/compat/sunos32/sunos32_misc.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60754 CVS commit: src/sys/compat/ultrix
Date: Sun, 20 Sep 2026 13:46:26 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:46:26 UTC 2026

 Modified Files:
 	src/sys/compat/ultrix: ultrix_ioctl.c ultrix_misc.c ultrix_pathname.c

 Log Message:
 compat_ultrix: Zero out syscall argument packages on stack.

 PR kern/60754: potential syscall argument package stack garbage


 To generate a diff of this commit:
 cvs rdiff -u -r1.40 -r1.41 src/sys/compat/ultrix/ultrix_ioctl.c \
     src/sys/compat/ultrix/ultrix_pathname.c
 cvs rdiff -u -r1.128 -r1.129 src/sys/compat/ultrix/ultrix_misc.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60754 CVS commit: src/sys/kern
Date: Sun, 20 Sep 2026 13:46:48 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:46:48 UTC 2026

 Modified Files:
 	src/sys/kern: init_main.c kern_time.c sys_epoll.c

 Log Message:
 kern: Zero out syscall argument packages on stack.

 PR kern/60754: potential syscall argument package stack garbage


 To generate a diff of this commit:
 cvs rdiff -u -r1.553 -r1.554 src/sys/kern/init_main.c
 cvs rdiff -u -r1.232 -r1.233 src/sys/kern/kern_time.c
 cvs rdiff -u -r1.4 -r1.5 src/sys/kern/sys_epoll.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60754 CVS commit: src/sys/rump/kern/lib
Date: Sun, 20 Sep 2026 13:47:04 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:47:03 UTC 2026

 Modified Files:
 	src/sys/rump/kern/lib/libsys_cygwin: rump_cygwin_compat.c
 	src/sys/rump/kern/lib/libsys_linux: linux_rump.c
 	src/sys/rump/kern/lib/libsys_sunos: rump_sunos_compat.c

 Log Message:
 rump libsys_*: Zero out syscall argument packages on stack.

 PR kern/60754: potential syscall argument package stack garbage


 To generate a diff of this commit:
 cvs rdiff -u -r1.3 -r1.4 \
     src/sys/rump/kern/lib/libsys_cygwin/rump_cygwin_compat.c
 cvs rdiff -u -r1.5 -r1.6 src/sys/rump/kern/lib/libsys_linux/linux_rump.c
 cvs rdiff -u -r1.4 -r1.5 \
     src/sys/rump/kern/lib/libsys_sunos/rump_sunos_compat.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Fri, 02 Oct 2026 03:27:31 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10

(note: separate PR 60750 for compat_linux)


>Unformatted:

Home	PR Database Search