From: Alex Elder <aelder@sgi.com>
To: Vasiliy Kulikov <segooon@gmail.com>
Cc: kernel-janitors@vger.kernel.org, xfs-masters@oss.sgi.com,
"Christoph Hellwig" <hch@lst.de>,
"Dave Chinner" <dchinner@redhat.com>,
"Eric Sandeen" <sandeen@redhat.com>,
"Arkadiusz Miśkiewicz" <arekm@maven.pl>,
xfs@oss.sgi.com, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] xfs: linux-2.6: xfs_ioctl: fix information leak to userland
Date: Fri, 05 Nov 2010 12:19:49 -0500 [thread overview]
Message-ID: <1288977589.2295.27.camel@doink> (raw)
In-Reply-To: <1288448778-5373-1-git-send-email-segooon@gmail.com>
On Sat, 2010-10-30 at 18:26 +0400, Vasiliy Kulikov wrote:
> al_hreq is copied from userland. If al_hreq.buflen is not properly aligned then
> xfs_attr_list will ignore the last bytes of kbuf. These bytes are unitialized.
> It leads to leaking of contents of kernel stack memory.
>
> Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
> ---
> Compile tested.
>
> fs/xfs/linux-2.6/xfs_ioctl.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
> index 2ea238f..ad442d9 100644
> --- a/fs/xfs/linux-2.6/xfs_ioctl.c
> +++ b/fs/xfs/linux-2.6/xfs_ioctl.c
> @@ -416,7 +416,7 @@ xfs_attrlist_by_handle(
> if (IS_ERR(dentry))
> return PTR_ERR(dentry);
>
> - kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
> + kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
> if (!kbuf)
> goto out_dput;
>
Looks good. I will take this in and will send
it to Linus for 2.6.37. Thanks.
Reviewed-by: Alex Elder <aelder@sgi.com>
prev parent reply other threads:[~2010-11-05 17:19 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-10-30 14:26 [PATCH] xfs: linux-2.6: xfs_ioctl: fix information leak to userland Vasiliy Kulikov
2010-11-05 17:19 ` Alex Elder [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1288977589.2295.27.camel@doink \
--to=aelder@sgi.com \
--cc=arekm@maven.pl \
--cc=dchinner@redhat.com \
--cc=hch@lst.de \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sandeen@redhat.com \
--cc=segooon@gmail.com \
--cc=xfs-masters@oss.sgi.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox