diff mbox

[-next] wan/fsl_ucc_hdlc: info leak in uhdlc_ioctl()

Message ID 20160714103415.GE18175@mwanda
State Changes Requested, archived
Delegated to: David Miller
Headers show

Commit Message

Dan Carpenter July 14, 2016, 10:34 a.m. UTC
There is a 2 byte struct whole after line.loopback so we need to clear
that out to avoid disclosing stack information.

Fixes: c19b6d246a35 ('drivers/net: support hdlc function for QE-UCC')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Walter Harms July 14, 2016, 10:52 a.m. UTC | #1
Am 14.07.2016 12:34, schrieb Dan Carpenter:
> There is a 2 byte struct whole after line.loopback so we need to clear
> that out to avoid disclosing stack information.
> 
> Fixes: c19b6d246a35 ('drivers/net: support hdlc function for QE-UCC')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
> index 19174ac..7608561 100644
> --- a/drivers/net/wan/fsl_ucc_hdlc.c
> +++ b/drivers/net/wan/fsl_ucc_hdlc.c
> @@ -635,6 +635,7 @@ static int uhdlc_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
>  			ifr->ifr_settings.size = size; /* data size wanted */
>  			return -ENOBUFS;
>  		}
> +		memset(&line, 0, sizeof(line));
>  		line.clock_type = priv->clocking;
>  		line.clock_rate = 0;
>  		line.loopback = 0;


In this case
  		line.clock_rate = 0;
 		line.loopback = 0;

are not need any more and can be removed
except like them to have for documentation or so.

re,
 wh
Dan Carpenter July 14, 2016, 11:17 a.m. UTC | #2
Good point.  Thanks.

regards,
dan carpenter
diff mbox

Patch

diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 19174ac..7608561 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -635,6 +635,7 @@  static int uhdlc_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 			ifr->ifr_settings.size = size; /* data size wanted */
 			return -ENOBUFS;
 		}
+		memset(&line, 0, sizeof(line));
 		line.clock_type = priv->clocking;
 		line.clock_rate = 0;
 		line.loopback = 0;