lkml.org 
[lkml]   [2013]   [Nov]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 86/87] Staging: bcm: info leak in ioctl
    3.2.53-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 8d1e72250c847fa96498ec029891de4dc638a5ba upstream.

    The DevInfo.u32Reserved[] array isn't initialized so it leaks kernel
    information to user space.

    Reported-by: Nico Golde <nico@ngolde.de>
    Reported-by: Fabian Yamaguchi <fabs@goesec.de>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/staging/bcm/Bcmchar.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/drivers/staging/bcm/Bcmchar.c
    +++ b/drivers/staging/bcm/Bcmchar.c
    @@ -1932,6 +1932,7 @@ cntrlEnd:

    BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, OSAL_DBG, DBG_LVL_ALL, "Called IOCTL_BCM_GET_DEVICE_DRIVER_INFO\n");

    + memset(&DevInfo, 0, sizeof(DevInfo));
    DevInfo.MaxRDMBufferSize = BUFFER_4K;
    DevInfo.u32DSDStartOffset = EEPROM_CALPARAM_START;
    DevInfo.u32RxAlignmentCorrection = 0;


    \
     
     \ /
      Last update: 2013-11-26 01:21    [W:2.716 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site