Skip to contentSkip to conversation

xfs: linux-2.6: xfs_ioctl: fix information leak to userland

PATCH In review Vasiliy Kulikov 2 participants 2 messages Oct 30, 2010 – Nov 5, 2010

Subsystems (2)
Kernel janitors XFS filesystem
lore
Share & tools
lore

Vasiliy Kulikov

author
#0 lore raw

PATCH 1/1 xfs: linux-2.6: xfs_ioctl: fix information leak to userland

al_hreq is copied from userland. If al_hreq.buflen is not properly aligned then xfs_attr_list will ignore the last bytes of kbuf. These bytes are unitialized. It leads to leaking of contents of kernel stack memory.

Signed-off-by Vasiliy Kulikov <[email protected]>

---
Compile tested.

 fs/xfs/linux-2.6/xfs_ioctl.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
fs/xfs/linux-2.6/xfs_ioctl.c +1 -1
index 2ea238f..ad442d9 100644
@@ -416,7 +416,7 @@ xfs_attrlist_by_handle(
 	if (IS_ERR(dentry))
 		return PTR_ERR(dentry);
 
-	kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
+	kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
 	if (!kbuf)
 		goto out_dput;
Signature · 6 lines
1.7.0.4

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
Reviewed-by on v1 1/1
#1 lore raw
Quoted 16 lines · Vasiliy Kulikov

al_hreq is copied from userland. If al_hreq.buflen is not properly aligned then xfs_attr_list will ignore the last bytes of kbuf. These bytes are unitialized. It leads to leaking of contents of kernel stack memory.

Signed-off-by Vasiliy Kulikov <[email protected]>

---
Compile tested.

 fs/xfs/linux-2.6/xfs_ioctl.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
fs/xfs/linux-2.6/xfs_ioctl.c +0 -0
index 2ea238f..ad442d9 100644

fs/xfs/linux-2.6/xfs_ioctl.c xfs_attrlist_by_handle( · line 422

Quoted 8 lines
fs/xfs/linux-2.6/xfs_ioctl.c +1 -1
@@ -416,7 +416,7 @@ xfs_attrlist_by_handle(
 	if (IS_ERR(dentry))
 		return PTR_ERR(dentry);
 
-	kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
+	kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
 	if (!kbuf)
 		goto out_dput;

Looks good. I will take this in and will send
it to Linus for 2.6.37. Thanks.

Reviewed-by Alex Elder <[email protected]>