paride: potential information leak in pg_read()
Subsystems (2)
PATCH 1/1 paride: potential information leak in pg_read()
Smatch has a new check for Rosenberg type information leaks where structs are copied to the user with uninitialized stack data in them. i
In this case, the pg_write_hdr struct has a hole in it.
struct pg_write_hdr {
char magic; /* 0 1 */
char func; /* 1 1 */ /* XXX 2 bytes hole, try to pack */
int dlen; /* 4 4 */
Signed-off-by Dan Carpenter <[email protected]>
drivers/block/paride/pg.c +1 -0
@@ -630,6 +630,7 @@ static ssize_t pg_read(struct file *filp, char __user *buf, size_t count, loff_tif (dev->status &0x10 )return -ETIME ; +memset (&hdr,0 ,sizeof (hdr)); hdr.magic =PG_MAGIC ; hdr.dlen = dev->dlen; copy =0 ;