Skip to contentSkip to conversation

fanotify: info leak in copy_event_to_user()

PATCH New Dan Carpenter 1 participant 1 message Jun 3, 2013

Subsystems (3)
Kernel janitors Fsnotify: filesystem notification infrastructure Fanotify
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 fanotify: info leak in copy_event_to_user()

The ->reserverd field isn't cleared so we leak one byte of stack information to userspace.

Signed-off-by Dan Carpenter <[email protected]>
fs/notify/fanotify/fanotify_user.c +1 -0
index 6c80083..77cc85d 100644
@@ -122,6 +122,7 @@ static int fill_event_metadata(struct fsnotify_group *group,
 	metadata->event_len = FAN_EVENT_METADATA_LEN;
 	metadata->metadata_len = FAN_EVENT_METADATA_LEN;
 	metadata->vers = FANOTIFY_METADATA_VERSION;
+	metadata->reserved = 0;
 	metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS;
 	metadata->pid = pid_vnr(event->tgid);
 	if (unlikely(event->mask & FAN_Q_OVERFLOW))