lkml.org 
[lkml]   [2011]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[34-longterm 143/260] xfs: prevent reading uninitialized stack memory
    Date
    From: Dan Rosenberg <dan.j.rosenberg@gmail.com>

    commit a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9 upstream.

    The XFS_IOC_FSGETXATTR ioctl allows unprivileged users to read 12
    bytes of uninitialized stack memory, because the fsxattr struct
    declared on the stack in xfs_ioc_fsgetxattr() does not alter (or zero)
    the 12-byte fsx_pad member before copying it back to the user. This
    patch takes care of it.

    Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
    Reviewed-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: Alex Elder <aelder@sgi.com>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    ---
    fs/xfs/linux-2.6/xfs_ioctl.c | 2 ++
    1 files changed, 2 insertions(+), 0 deletions(-)

    diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
    index 7b26cc2..3da1da7 100644
    --- a/fs/xfs/linux-2.6/xfs_ioctl.c
    +++ b/fs/xfs/linux-2.6/xfs_ioctl.c
    @@ -791,6 +791,8 @@ xfs_ioc_fsgetxattr(
    {
    struct fsxattr fa;

    + memset(&fa, 0, sizeof(struct fsxattr));
    +
    xfs_ilock(ip, XFS_ILOCK_SHARED);
    fa.fsx_xflags = xfs_ip2xflags(ip);
    fa.fsx_extsize = ip->i_d.di_extsize << ip->i_mount->m_sb.sb_blocklog;
    --
    1.7.3.3


    \
     
     \ /
      Last update: 2011-01-02 08:51    [W:4.369 / U:0.752 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site