From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasha Levin Date: Sat, 11 Apr 2020 23:08:47 +0000 Subject: [PATCH AUTOSEL 5.4 052/108] fbdev: potential information leak in do_fb_ioctl() Message-Id: <20200411230943.24951-52-sashal@kernel.org> List-Id: References: <20200411230943.24951-1-sashal@kernel.org> In-Reply-To: <20200411230943.24951-1-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sasha Levin , Daniel Thompson , Gerd Hoffmann , Arnd Bergmann , Bartlomiej Zolnierkiewicz , Jani Nikula , Daniel Vetter , linux-fbdev@vger.kernel.org, dri-devel@lists.freedesktop.org, "Eric W. Biederman" , Andrew Morton , Sam Ravnborg , Peter Rosin , Dan Carpenter , Andrea Righi From: Dan Carpenter [ Upstream commit d3d19d6fc5736a798b118971935ce274f7deaa82 ] The "fix" struct has a 2 byte hole after ->ywrapstep and the "fix = info->fix;" assignment doesn't necessarily clear it. It depends on the compiler. The solution is just to replace the assignment with an memcpy(). Fixes: 1f5e31d7e55a ("fbmem: don't call copy_from/to_user() with mutex held") Signed-off-by: Dan Carpenter Cc: Andrew Morton Cc: Arnd Bergmann Cc: "Eric W. Biederman" Cc: Andrea Righi Cc: Daniel Vetter Cc: Sam Ravnborg Cc: Maarten Lankhorst Cc: Daniel Thompson Cc: Peter Rosin Cc: Jani Nikula Cc: Gerd Hoffmann Signed-off-by: Bartlomiej Zolnierkiewicz Link: https://patchwork.freedesktop.org/patch/msgid/20200113100132.ixpaymordi24n3av@kili.mountain Signed-off-by: Sasha Levin --- drivers/video/fbdev/core/fbmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index e6a1c805064f0..36469943795a8 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -1110,7 +1110,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, break; case FBIOGET_FSCREENINFO: lock_fb_info(info); - fix = info->fix; + memcpy(&fix, &info->fix, sizeof(fix)); if (info->flags & FBINFO_HIDE_SMEM_START) fix.smem_start = 0; unlock_fb_info(info); -- 2.20.1