Skip to contentSkip to conversation

char: hpet: fix information leak to userland

PATCH In review Vasiliy Kulikov 2 participants 2 messages Oct 17, 2010 – Oct 18, 2010

Subsystems (3)
Kernel janitors Char and misc drivers Hpet: High Precision Event Timers driver
lore
Share & tools
lore

Vasiliy Kulikov

author
#0 lore raw

PATCH 2/8 char: hpet: fix information leak to userland

Structure info is copied to userland with some padding fields unitialized. It leads to leaking of stack memory.

Signed-off-by Vasiliy Kulikov <[email protected]>

---
Compile tested.

 drivers/char/hpet.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
drivers/char/hpet.c +1 -0
index a4eee32..f6722ef 100644
@@ -581,6 +581,7 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
 		break;
 	case HPET_INFO:
 		{
+			memset(info, 0, sizeof(*info));
 			if (devp->hd_ireqfreq)
 				info->hi_ireqfreq  					hpet_time_div(hpetp, devp->hd_ireqfreq);
Signature · 1 line
1.7.0.4
maintainer
#1 lore raw

drivers/char/hpet.c hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, · line 587

Quoted 13 lines · Vasiliy Kulikov

Structure info is copied to userland with some padding fields unitialized. It leads to leaking of stack memory.

drivers/char/hpet.c +1 -0
@@ -581,6 +581,7 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
 		break;
 	case HPET_INFO:
 		{
+			memset(info, 0, sizeof(*info));
 			if (devp->hd_ireqfreq)
 				info->hi_ireqfreq =
 					hpet_time_div(hpetp, devp->hd_ireqfreq);

This makes the following assignment "info->hi_ireqfreq = 0;" superfluous.

Regards,
Clemens