Messages in this thread Patch in this message | | | From | Kees Cook <> | Subject | [PATCH] ipc: explicitly clear stack memory for shminfo | Date | Tue, 16 Nov 2010 11:58:28 -0800 |
| |
This fixes a kernel stack memory contents leak by explicitly clearing the shminfo structure on the kernel stack before it is populated and copied back to userspace.
Signed-off-by: Kees Cook <kees.cook@canonical.com> Acked-by: Pekka Enberg <penberg@kernel.org> --- ipc/shm.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/ipc/shm.c b/ipc/shm.c index 7d3bb22..1d3d41f 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -531,6 +531,7 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf { struct shminfo out; + memset(&out, 0, sizeof(out)); if(in->shmmax > INT_MAX) out.shmmax = INT_MAX; else -- 1.7.2.3
| |