* [PATCH 5/8] char: ppdev: fix information leak to userland
@ 2010-10-17 14:41 Vasiliy Kulikov
0 siblings, 0 replies; only message in thread
From: Vasiliy Kulikov @ 2010-10-17 14:41 UTC (permalink / raw)
To: kernel-janitors
Cc: Andrew Morton, Julia Lawall, Tejun Heo, Arnd Bergmann,
linux-kernel
Structure par_timeout is copied to userland with some padding fields unitialized.
Field tv_usec has type __kernel_suseconds_t, it differs from tv_sec's type on
some architectures. It leads to leaking of stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
---
Compile tested.
drivers/char/ppdev.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index 723152d..f176dba 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -613,6 +613,7 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
case PPGETTIME:
to_jiffies = pp->pdev->timeout;
+ memset(&par_timeout, 0, sizeof(par_timeout));
par_timeout.tv_sec = to_jiffies / HZ;
par_timeout.tv_usec = (to_jiffies % (long)HZ) * (1000000/HZ);
if (copy_to_user (argp, &par_timeout, sizeof(struct timeval)))
--
1.7.0.4
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2010-10-17 14:41 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-10-17 14:41 [PATCH 5/8] char: ppdev: fix information leak to userland Vasiliy Kulikov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).