lkml.org 
[lkml]   [2010]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH] drivers/usb/serial/mos*: prevent reading uninitialized stack memory
From
Date
The TIOCGICOUNT device ioctl in both mos7720.c and mos7840.c allows
unprivileged users to read uninitialized stack memory, because the
"reserved" member of the serial_icounter_struct struct declared on the
stack is not altered or zeroed before being copied back to the user.
This patch takes care of it.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>

diff -urp linux-2.6.35.4.orig/drivers/usb/serial/mos7720.c linux-2.6.35.4/drivers/usb/serial/mos7720.c
--- linux-2.6.35.4.orig/drivers/usb/serial/mos7720.c 2010-08-26 19:47:12.000000000 -0400
+++ linux-2.6.35.4/drivers/usb/serial/mos7720.c 2010-09-15 11:42:01.877375361 -0400
@@ -2024,6 +2024,9 @@ static int mos7720_ioctl(struct tty_stru

case TIOCGICOUNT:
cnow = mos7720_port->icount;
+
+ memset(&icount, 0, sizeof(struct serial_icounter_struct));
+
icount.cts = cnow.cts;
icount.dsr = cnow.dsr;
icount.rng = cnow.rng;
diff -urp linux-2.6.35.4.orig/drivers/usb/serial/mos7840.c linux-2.6.35.4/drivers/usb/serial/mos7840.c
--- linux-2.6.35.4.orig/drivers/usb/serial/mos7840.c 2010-08-26 19:47:12.000000000 -0400
+++ linux-2.6.35.4/drivers/usb/serial/mos7840.c 2010-09-15 11:42:39.237375173 -0400
@@ -2273,6 +2273,9 @@ static int mos7840_ioctl(struct tty_stru
case TIOCGICOUNT:
cnow = mos7840_port->icount;
smp_rmb();
+
+ memset(&icount, 0, sizeof(struct serial_icounter_struct));
+
icount.cts = cnow.cts;
icount.dsr = cnow.dsr;
icount.rng = cnow.rng;







\
 
 \ /
  Last update: 2010-09-15 23:53    [W:0.149 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site