lkml.org 
[lkml]   [2010]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH] drivers/usb/serial/mos*: prevent reading uninitialized stack memory
    From
    Date
    The TIOCGICOUNT device ioctl in both mos7720.c and mos7840.c allows
    unprivileged users to read uninitialized stack memory, because the
    "reserved" member of the serial_icounter_struct struct declared on the
    stack is not altered or zeroed before being copied back to the user.
    This patch takes care of it.

    Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>

    diff -urp linux-2.6.35.4.orig/drivers/usb/serial/mos7720.c linux-2.6.35.4/drivers/usb/serial/mos7720.c
    --- linux-2.6.35.4.orig/drivers/usb/serial/mos7720.c 2010-08-26 19:47:12.000000000 -0400
    +++ linux-2.6.35.4/drivers/usb/serial/mos7720.c 2010-09-15 11:42:01.877375361 -0400
    @@ -2024,6 +2024,9 @@ static int mos7720_ioctl(struct tty_stru

    case TIOCGICOUNT:
    cnow = mos7720_port->icount;
    +
    + memset(&icount, 0, sizeof(struct serial_icounter_struct));
    +
    icount.cts = cnow.cts;
    icount.dsr = cnow.dsr;
    icount.rng = cnow.rng;
    diff -urp linux-2.6.35.4.orig/drivers/usb/serial/mos7840.c linux-2.6.35.4/drivers/usb/serial/mos7840.c
    --- linux-2.6.35.4.orig/drivers/usb/serial/mos7840.c 2010-08-26 19:47:12.000000000 -0400
    +++ linux-2.6.35.4/drivers/usb/serial/mos7840.c 2010-09-15 11:42:39.237375173 -0400
    @@ -2273,6 +2273,9 @@ static int mos7840_ioctl(struct tty_stru
    case TIOCGICOUNT:
    cnow = mos7840_port->icount;
    smp_rmb();
    +
    + memset(&icount, 0, sizeof(struct serial_icounter_struct));
    +
    icount.cts = cnow.cts;
    icount.dsr = cnow.dsr;
    icount.rng = cnow.rng;







    \
     
     \ /
      Last update: 2010-09-15 23:53    [W:0.025 / U:1.236 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site