* [PATCH] hamradio/yam: fix info leak in ioctl
@ 2013-12-13 7:46 Salva Peiró
2013-12-17 1:11 ` David Miller
2013-12-17 9:06 ` [PATCH v2] " Salva Peiró
0 siblings, 2 replies; 4+ messages in thread
From: Salva Peiró @ 2013-12-13 7:46 UTC (permalink / raw)
To: linux-kernel
Cc: security, linux-hams, netdev, Jean-Paul Roubelat,
Salva Peiró, stable
The yam_ioctl() code fails to initialise the cmd field
of the struct yamdrv_ioctl_cfg. Add an explicit memset(0)
before filling the structure to avoid the 4-byte info leak.
Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
CC: <stable@vger.kernel.org>
---
drivers/net/hamradio/yam.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 1971411..bb02c8a 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -953,6 +953,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
struct yamdrv_ioctl_mcs *ym;
int ioctl_cmd;
+ memset(&yi, 0, sizeof(yi));
if (copy_from_user(&ioctl_cmd, ifr->ifr_data, sizeof(int)))
return -EFAULT;
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe linux-hams" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] hamradio/yam: fix info leak in ioctl
2013-12-13 7:46 [PATCH] hamradio/yam: fix info leak in ioctl Salva Peiró
@ 2013-12-17 1:11 ` David Miller
2013-12-17 9:06 ` [PATCH v2] " Salva Peiró
1 sibling, 0 replies; 4+ messages in thread
From: David Miller @ 2013-12-17 1:11 UTC (permalink / raw)
To: speiro; +Cc: linux-kernel, security, linux-hams, netdev, jpr, stable
From: Salva Peiró <speiro@ai2.upv.es>
Date: Fri, 13 Dec 2013 08:46:07 +0100
> The yam_ioctl() code fails to initialise the cmd field
> of the struct yamdrv_ioctl_cfg. Add an explicit memset(0)
> before filling the structure to avoid the 4-byte info leak.
>
> Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Put this into the SIOCYAMGCFG case statement, which is where the
problem actually exists.
--
To unsubscribe from this list: send the line "unsubscribe linux-hams" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v2] hamradio/yam: fix info leak in ioctl
2013-12-13 7:46 [PATCH] hamradio/yam: fix info leak in ioctl Salva Peiró
2013-12-17 1:11 ` David Miller
@ 2013-12-17 9:06 ` Salva Peiró
2013-12-19 20:09 ` David Miller
1 sibling, 1 reply; 4+ messages in thread
From: Salva Peiró @ 2013-12-17 9:06 UTC (permalink / raw)
To: linux-kernel
Cc: Salva Peiró, security, linux-hams, netdev,
Jean-Paul Roubelat, stable
The yam_ioctl() code fails to initialise the cmd field
of the struct yamdrv_ioctl_cfg. Add an explicit memset(0)
before filling the structure to avoid the 4-byte info leak.
Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
CC: <stable@vger.kernel.org>
---
drivers/net/hamradio/yam.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 1971411..61dd244 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -1057,6 +1057,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
break;
case SIOCYAMGCFG:
+ memset(&yi, 0, sizeof(yi));
yi.cfg.mask = 0xffffffff;
yi.cfg.iobase = yp->iobase;
yi.cfg.irq = yp->irq;
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe linux-hams" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] hamradio/yam: fix info leak in ioctl
2013-12-17 9:06 ` [PATCH v2] " Salva Peiró
@ 2013-12-19 20:09 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2013-12-19 20:09 UTC (permalink / raw)
To: speiro; +Cc: linux-kernel, security, linux-hams, netdev, jpr, stable
From: Salva Peiró <speiro@ai2.upv.es>
Date: Tue, 17 Dec 2013 10:06:30 +0100
> The yam_ioctl() code fails to initialise the cmd field
> of the struct yamdrv_ioctl_cfg. Add an explicit memset(0)
> before filling the structure to avoid the 4-byte info leak.
>
> Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Applied and queued up for -stable, thanks.
--
To unsubscribe from this list: send the line "unsubscribe linux-hams" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-12-19 20:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-12-13 7:46 [PATCH] hamradio/yam: fix info leak in ioctl Salva Peiró
2013-12-17 1:11 ` David Miller
2013-12-17 9:06 ` [PATCH v2] " Salva Peiró
2013-12-19 20:09 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).