[Linux-kernel-mentees] [PATCH] firewire: Prevent kernel-infoleak in ioctl_get_info()

Peilin Ye yepeilin.cs at gmail.com
Mon Jul 27 15:15:37 UTC 2020


ioctl_get_info() is copying uninitialized stack memory to userspace due to
the compiler not initializing holes in statically allocated structures.
Fix it by initializing `event` using memset() in fill_bus_reset_event().

Cc: stable at vger.kernel.org
Suggested-by: Dan Carpenter <dan.carpenter at oracle.com>
Suggested-by: Arnd Bergmann <arnd at arndb.de>
Signed-off-by: Peilin Ye <yepeilin.cs at gmail.com>
---
 drivers/firewire/core-cdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index fb6c651214f3..2341d762df5b 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -340,6 +340,8 @@ static void fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
 {
 	struct fw_card *card = client->device->card;
 
+	memset(event, 0, sizeof(*event));
+
 	spin_lock_irq(&card->lock);
 
 	event->closure	     = client->bus_reset_closure;
-- 
2.25.1



More information about the Linux-kernel-mentees mailing list