Skip to contentSkip to conversation

block: ioctl: fix information leak to userland

PATCH Applied Vasiliy Kulikov 2 participants 2 messages Nov 4, 2010 – Nov 8, 2010

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 block: ioctl: fix information leak to userland

Structure hd_geometry is copied to userland with 4 padding bytes between cylinders and start fields uninitialized on 64-bit platforms. It leads to leaking of contents of kernel stack memory.

Currently there is no memset() in real implementations of getgeo() in drivers/block/, so it makes sense to have memset() in blkdev_ioctl().

---
 block/ioctl.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
block/ioctl.c +1 -0
index d724ceb..60bae81 100644
@@ -242,6 +242,7 @@ int blkdev_ioctl(struct block_device *bdev, fmode_t mode, unsigned cmd,
 		 * We need to set the startsect first, the driver may
 		 * want to override it.
 		 */
+		memset(&geo, 0, sizeof(geo));
 		geo.start = get_start_sect(bdev);
 		ret = disk->fops->getgeo(bdev, &geo);
 		if (ret)
Signature · 1 line
1.7.0.4
maintainer Applied
#1 lore raw
Quoted 6 lines · Vasiliy Kulikov

Structure hd_geometry is copied to userland with 4 padding bytes between cylinders and start fields uninitialized on 64-bit platforms. It leads to leaking of contents of kernel stack memory.

Currently there is no memset() in real implementations of getgeo() in drivers/block/, so it makes sense to have memset() in blkdev_ioctl().

Thanks, applied.

Signature · 1 line
Jens Axboe