lkml.org 
[lkml]   [2010]   [Sep]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[02/80] USB: serial/mos*: prevent reading uninitialized stack memory
    2.6.35-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Dan Rosenberg <drosenberg@vsecurity.com>

    commit a0846f1868b11cd827bdfeaf4527d8b1b1c0b098 upstream.

    The TIOCGICOUNT device ioctl in both mos7720.c and mos7840.c allows
    unprivileged users to read uninitialized stack memory, because the
    "reserved" member of the serial_icounter_struct struct declared on the
    stack is not altered or zeroed before being copied back to the user.
    This patch takes care of it.

    Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/usb/serial/mos7720.c | 3 +++
    drivers/usb/serial/mos7840.c | 3 +++
    2 files changed, 6 insertions(+)

    --- a/drivers/usb/serial/mos7720.c
    +++ b/drivers/usb/serial/mos7720.c
    @@ -2024,6 +2024,9 @@ static int mos7720_ioctl(struct tty_stru

    case TIOCGICOUNT:
    cnow = mos7720_port->icount;
    +
    + memset(&icount, 0, sizeof(struct serial_icounter_struct));
    +
    icount.cts = cnow.cts;
    icount.dsr = cnow.dsr;
    icount.rng = cnow.rng;
    --- a/drivers/usb/serial/mos7840.c
    +++ b/drivers/usb/serial/mos7840.c
    @@ -2285,6 +2285,9 @@ static int mos7840_ioctl(struct tty_stru
    case TIOCGICOUNT:
    cnow = mos7840_port->icount;
    smp_rmb();
    +
    + memset(&icount, 0, sizeof(struct serial_icounter_struct));
    +
    icount.cts = cnow.cts;
    icount.dsr = cnow.dsr;
    icount.rng = cnow.rng;



    \
     
     \ /
      Last update: 2010-09-27 20:09    [W:4.022 / U:0.528 seconds]
    ©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site