block: ioctl: fix information leak to userland
Subsystems (2)
PATCH 1/1 block: ioctl: fix information leak to userland
Structure hd_geometry is copied to userland with 4 padding bytes between cylinders and start fields uninitialized on 64-bit platforms. It leads to leaking of contents of kernel stack memory.
Currently there is no memset() in real implementations of getgeo() in drivers/block/, so it makes sense to have memset() in blkdev_ioctl().
Signed-off-by Vasiliy Kulikov <[email protected]>
--- block/ioctl.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
block/ioctl.c +1 -0
@@ -242,6 +242,7 @@ int blkdev_ioctl(struct block_device *bdev, fmode_t mode, unsigned cmd,* We need to set the startsect first, the driver may * want to override it. */ +memset (&geo,0 ,sizeof (geo)); geo.start =get_start_sect (bdev); ret = disk->fops->getgeo (bdev, &geo);if (ret)
Signature · 1 line
1.7.0.4
Quoted 6 lines · Vasiliy Kulikov
Structure
hd_geometryis copied to userland with 4 padding bytes between cylinders and start fields uninitialized on 64-bit platforms. It leads to leaking of contents of kernel stack memory.Currently there is no
memset()in real implementations ofgetgeo()indrivers/block/, so it makes sense to havememset()inblkdev_ioctl().
Thanks, applied.
Signature · 1 line
Jens Axboe