Patchwork mtd: mtdchar: fix information leak to userland

login
register
mail settings
Submitter Kulikov Vasiliy
Date Nov. 6, 2010, 2:41 p.m.
Message ID <1289054485-18190-1-git-send-email-segooon@gmail.com>
Download mbox | patch
Permalink /patch/70328/
State Accepted
Commit a0c5a3944ce121bb2417c771f77b18485cd84e18
Headers show

Comments

Kulikov Vasiliy - Nov. 6, 2010, 2:41 p.m.
Structure mtd_info_user is copied to userland with padding byted
between "type" and "flags" fields uninitialized.  It leads to leaking
of contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
---
 Compile tested.

 drivers/mtd/mtdchar.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
Artem Bityutskiy - Nov. 26, 2010, 3:37 p.m.
On Sat, 2010-11-06 at 17:41 +0300, Vasiliy Kulikov wrote:
> Structure mtd_info_user is copied to userland with padding byted
> between "type" and "flags" fields uninitialized.  It leads to leaking
> of contents of kernel stack memory.
> 
> Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>

Pushed to l2-mtd-2.6.git, thanks.

Patch

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 3eff1e5..2a0bc9e 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -601,6 +601,7 @@  static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
 	}
 
 	case MEMGETINFO:
+		memset(&info, 0, sizeof(info));
 		info.type	= mtd->type;
 		info.flags	= mtd->flags;
 		info.size	= mtd->size;
@@ -609,7 +610,6 @@  static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
 		info.oobsize	= mtd->oobsize;
 		/* The below fields are obsolete */
 		info.ecctype	= -1;
-		info.eccsize	= 0;
 		if (copy_to_user(argp, &info, sizeof(struct mtd_info_user)))
 			return -EFAULT;
 		break;