Fix some error branches in cmsg file descriptor passing.

- Don't leave garbage in the control buffer when allocating file
descriptors fails in unp_externalize.

- Scrub the space between CMSG_LEN and CMSG_SPACE to avoid kernel
memory disclosure in unp_externalize.

- Don't read past cmsg_len when closing file descriptors that couldn't
get delivered in free_rights.

Index: sys/kern/uipc_syscalls.c
===================================================================
RCS file: /cvsroot/src/sys/kern/uipc_syscalls.c,v
retrieving revision 1.154.2.2
diff -p -u -r1.154.2.2 uipc_syscalls.c
--- sys/kern/uipc_syscalls.c	7 Jan 2013 16:53:18 -0000	1.154.2.2
+++ sys/kern/uipc_syscalls.c	14 Feb 2013 00:07:18 -0000
@@ -738,17 +738,21 @@ sys_recvmsg(struct lwp *l, const struct 
 static void
 free_rights(struct mbuf *m)
 {
-	int nfd;
-	int i;
+	struct cmsghdr *cm;
 	int *fdv;
+	unsigned int nfds, i;
 
-	nfd = m->m_len < CMSG_SPACE(sizeof(int)) ? 0
-	    : (m->m_len - CMSG_SPACE(sizeof(int))) / sizeof(int) + 1;
-	fdv = (int *) CMSG_DATA(mtod(m,struct cmsghdr *));
-	for (i = 0; i < nfd; i++) {
+	KASSERT(sizeof(*cm) <= m->m_len);
+	cm = mtod(m, struct cmsghdr *);
+
+	KASSERT(CMSG_ALIGN(sizeof(*cm)) <= cm->cmsg_len);
+	KASSERT(cm->cmsg_len <= m->m_len);
+	nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / sizeof(int);
+	fdv = (int *)CMSG_DATA(cm);
+
+	for (i = 0; i < nfds; i++)
 		if (fd_getfile(fdv[i]) != NULL)
 			(void)fd_close(fdv[i]);
-	}
 }
 
 void
Index: sys/kern/uipc_usrreq.c
===================================================================
RCS file: /cvsroot/src/sys/kern/uipc_usrreq.c,v
retrieving revision 1.136.8.2
diff -p -u -r1.136.8.2 uipc_usrreq.c
--- sys/kern/uipc_usrreq.c	9 Oct 2012 23:45:21 -0000	1.136.8.2
+++ sys/kern/uipc_usrreq.c	14 Feb 2013 00:07:19 -0000
@@ -1336,14 +1336,24 @@ unp_externalize(struct mbuf *rights, str
 	}
  out:
 	if (__predict_false(error != 0)) {
-		rp = (file_t **)CMSG_DATA(cm);
-		for (size_t i = 0; i < nfds; i++) {
-			file_t * const fp = *rp;
-			*rp++ = 0;
-			unp_discard_now(fp);
-		}
+		file_t **const fpp = (file_t **)CMSG_DATA(cm);
+		for (size_t i = 0; i < nfds; i++)
+			unp_discard_now(fpp[i]);
+		/*
+		 * Truncate the array so that nobody will try to interpret
+		 * what is now garbage in it.
+		 */
+		cm->cmsg_len = CMSG_LEN(0);
+		rights->m_len = CMSG_SPACE(0);
 	}
 
+	/*
+	 * Don't disclose kernel memory in the alignment space.
+	 */
+	KASSERT(cm->cmsg_len <= rights->m_len);
+	memset(&mtod(rights, char *)[cm->cmsg_len], 0, rights->m_len -
+	    cm->cmsg_len);
+
 	rw_exit(&p->p_cwdi->cwdi_lock);
 	kmem_free(fdp, nfds * sizeof(int));
 	return error;