ipmi: info leak in compat_impi_ioctl()

PATCH Superseded Dan Carpenter 1 participant 1 message Apr 15, 2013

Subsystems (2)

Kernel janitors IPMI

lore

Share & tools

lore

Dan Carpenter

author

2013-04-15 07:50 UTC #0 lore raw

PATCH 1/1 ipmi: info leak in compat_impi_ioctl()

There is a 4 byte hole between ->recv_type and ->addr.

Signed-off-by Dan Carpenter <[email protected]>

drivers/char/ipmi/ipmi_devintf.c +1 -0

index 9eb360f..8e306ac 100644
@@ -810,6 +810,7 @@ static long compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
 		struct ipmi_recv   __user *precv64;
 		struct ipmi_recv   recv64;
 
+		memset(&recv64, 0, sizeof(recv64));
 		if (get_compat_ipmi_recv(&recv64, compat_ptr(arg)))
 			return -EFAULT;