* [patch 3/3] drivers/serial/serial_core.c: prevent reading uninitialized stack memory
@ 2010-10-01 21:18 akpm
2010-10-06 20:20 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: akpm @ 2010-10-01 21:18 UTC (permalink / raw)
To: greg; +Cc: linux-serial, akpm, drosenberg, alan, dan.j.rosenberg
From: Dan Rosenberg <drosenberg@vsecurity.com>
The TIOCGICOUNT device ioctl allows unprivileged users to read
uninitialized stack memory, because the "reserved" member of the
serial_icounter_struct struct declared on the stack is not altered or
zeroed before being copied back to the user. This patch takes care of it.
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
drivers/serial/serial_core.c | 2 ++
1 file changed, 2 insertions(+)
diff -puN drivers/serial/serial_core.c~drivers-serial-serial_corec-prevent-reading-uninitialized-stack-memory drivers/serial/serial_core.c
--- a/drivers/serial/serial_core.c~drivers-serial-serial_corec-prevent-reading-uninitialized-stack-memory
+++ a/drivers/serial/serial_core.c
@@ -1081,6 +1081,8 @@ static int uart_get_icount(struct tty_st
struct uart_icount cnow;
struct uart_port *uport = state->uart_port;
+ memset(&icount, 0, sizeof(struct serial_icounter_struct));
+
spin_lock_irq(&uport->lock);
memcpy(&cnow, &uport->icount, sizeof(struct uart_icount));
spin_unlock_irq(&uport->lock);
_
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [patch 3/3] drivers/serial/serial_core.c: prevent reading uninitialized stack memory
2010-10-01 21:18 [patch 3/3] drivers/serial/serial_core.c: prevent reading uninitialized stack memory akpm
@ 2010-10-06 20:20 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2010-10-06 20:20 UTC (permalink / raw)
To: akpm; +Cc: linux-serial, drosenberg, alan, dan.j.rosenberg
On Fri, Oct 01, 2010 at 02:18:04PM -0700, akpm@linux-foundation.org wrote:
> From: Dan Rosenberg <drosenberg@vsecurity.com>
>
> The TIOCGICOUNT device ioctl allows unprivileged users to read
> uninitialized stack memory, because the "reserved" member of the
> serial_icounter_struct struct declared on the stack is not altered or
> zeroed before being copied back to the user. This patch takes care of it.
>
> Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
> Cc: Greg KH <greg@kroah.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
>
> drivers/serial/serial_core.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff -puN drivers/serial/serial_core.c~drivers-serial-serial_corec-prevent-reading-uninitialized-stack-memory drivers/serial/serial_core.c
> --- a/drivers/serial/serial_core.c~drivers-serial-serial_corec-prevent-reading-uninitialized-stack-memory
> +++ a/drivers/serial/serial_core.c
> @@ -1081,6 +1081,8 @@ static int uart_get_icount(struct tty_st
> struct uart_icount cnow;
> struct uart_port *uport = state->uart_port;
>
> + memset(&icount, 0, sizeof(struct serial_icounter_struct));
This patch is no longer needed as Alan fixed it in the tty core.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-10-06 20:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-10-01 21:18 [patch 3/3] drivers/serial/serial_core.c: prevent reading uninitialized stack memory akpm
2010-10-06 20:20 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).