From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Colin Ian King <colin.king@canonical.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.18 05/22] irda: do not leak initialized list.dev to userspace
Date: Mon, 28 Aug 2017 10:05:49 +0200 [thread overview]
Message-ID: <20170828080454.033077684@linuxfoundation.org> (raw)
In-Reply-To: <20170828080453.804109196@linuxfoundation.org>
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit b024d949a3c24255a7ef1a470420eb478949aa4c ]
list.dev has not been initialized and so the copy_to_user is copying
data from the stack back to user space which is a potential
information leak. Fix this ensuring all of list is initialized to
zero.
Detected by CoverityScan, CID#1357894 ("Uninitialized scalar variable")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/irda/af_irda.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2251,7 +2251,7 @@ static int irda_getsockopt(struct socket
{
struct sock *sk = sock->sk;
struct irda_sock *self = irda_sk(sk);
- struct irda_device_list list;
+ struct irda_device_list list = { 0 };
struct irda_device_info *discoveries;
struct irda_ias_set * ias_opt; /* IAS get/query params */
struct ias_object * ias_obj; /* Object in IAS */
next prev parent reply other threads:[~2017-08-28 8:16 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-28 8:05 [PATCH 3.18 00/22] 3.18.68-stable review Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 01/22] dccp: purge write queue in dccp_destroy_sock() Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 02/22] dccp: defer ccid_hc_tx_delete() at dismantle time Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 03/22] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 04/22] tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP Greg Kroah-Hartman
2017-08-28 8:05 ` Greg Kroah-Hartman [this message]
2017-08-28 8:05 ` [PATCH 3.18 06/22] net: sched: fix NULL pointer dereference when action calls some targets Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 07/22] net_sched: fix order of queue length updates in qdisc_replace() Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 08/22] Input: trackpoint - add new trackpoint firmware ID Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 09/22] ALSA: core: Fix unexpected error at replacing user TLV Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 10/22] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 12/22] tracing: Fix freeing of filter in create_filter() when set_str is false Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 13/22] cifs: Fix df output for users with quota limits Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 14/22] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Greg Kroah-Hartman
2017-08-28 8:05 ` [PATCH 3.18 15/22] nfsd: Limit end of page list when decoding NFSv4 WRITE Greg Kroah-Hartman
2017-08-28 8:06 ` [PATCH 3.18 16/22] perf/core: Fix group {cpu,task} validation Greg Kroah-Hartman
2017-08-28 8:06 ` [PATCH 3.18 17/22] Bluetooth: hidp: fix possible might sleep error in hidp_session_thread Greg Kroah-Hartman
2017-08-28 8:06 ` [PATCH 3.18 18/22] Bluetooth: cmtp: fix possible might sleep error in cmtp_session Greg Kroah-Hartman
2017-08-28 8:06 ` [PATCH 3.18 19/22] Bluetooth: bnep: fix possible might sleep error in bnep_session Greg Kroah-Hartman
2017-08-28 8:06 ` [PATCH 3.18 20/22] iio: imu: adis16480: Fix acceleration scale factor for adis16480 Greg Kroah-Hartman
2017-08-28 8:06 ` [PATCH 3.18 21/22] staging: rtl8188eu: add RNX-N150NUB support Greg Kroah-Hartman
2017-08-28 8:06 ` [PATCH 3.18 22/22] ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal Greg Kroah-Hartman
2017-08-28 19:37 ` [PATCH 3.18 00/22] 3.18.68-stable review Shuah Khan
2017-08-29 0:08 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170828080454.033077684@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=colin.king@canonical.com \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox