char: ppdev: fix information leak to userland

PATCH In review Vasiliy Kulikov 1 participant 1 message Oct 17, 2010

Subsystems (3)

Kernel janitors Char and misc drivers Parallel port

lore

Share & tools

lore

Vasiliy Kulikov

author

2010-10-17 14:41 UTC #0 lore raw

PATCH 5/8 char: ppdev: fix information leak to userland

Structure par_timeout is copied to userland with some padding fields unitialized. Field tv_usec has type __kernel_suseconds_t, it differs from tv_sec's type on some architectures. It leads to leaking of stack memory.

Signed-off-by Vasiliy Kulikov <[email protected]>

---
Compile tested.

 drivers/char/ppdev.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

drivers/char/ppdev.c +1 -0

index 723152d..f176dba 100644
@@ -613,6 +613,7 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
 	case PPGETTIME:
 		to_jiffies = pp->pdev->timeout;
+		memset(&par_timeout, 0, sizeof(par_timeout));
 		par_timeout.tv_sec = to_jiffies / HZ;
 		par_timeout.tv_usec = (to_jiffies % (long)HZ) * (1000000/HZ);
 		if (copy_to_user (argp, &par_timeout, sizeof(struct timeval)))

Signature · 1 line

1.7.0.4