lkml.org 
[lkml]   [2011]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[34-longterm 109/260] USB: serial/mos*: prevent reading uninitialized stack memory
    Date
    From: Dan Rosenberg <drosenberg@vsecurity.com>

    commit a0846f1868b11cd827bdfeaf4527d8b1b1c0b098 upstream.

    The TIOCGICOUNT device ioctl in both mos7720.c and mos7840.c allows
    unprivileged users to read uninitialized stack memory, because the
    "reserved" member of the serial_icounter_struct struct declared on the
    stack is not altered or zeroed before being copied back to the user.
    This patch takes care of it.

    Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    ---
    drivers/usb/serial/mos7720.c | 3 +++
    drivers/usb/serial/mos7840.c | 3 +++
    2 files changed, 6 insertions(+), 0 deletions(-)

    diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
    index 0d47f2c..623a6d3 100644
    --- a/drivers/usb/serial/mos7720.c
    +++ b/drivers/usb/serial/mos7720.c
    @@ -1566,6 +1566,9 @@ static int mos7720_ioctl(struct tty_struct *tty, struct file *file,

    case TIOCGICOUNT:
    cnow = mos7720_port->icount;
    +
    + memset(&icount, 0, sizeof(struct serial_icounter_struct));
    +
    icount.cts = cnow.cts;
    icount.dsr = cnow.dsr;
    icount.rng = cnow.rng;
    diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
    index a73f2f5..16f0548 100644
    --- a/drivers/usb/serial/mos7840.c
    +++ b/drivers/usb/serial/mos7840.c
    @@ -2286,6 +2286,9 @@ static int mos7840_ioctl(struct tty_struct *tty, struct file *file,
    case TIOCGICOUNT:
    cnow = mos7840_port->icount;
    smp_rmb();
    +
    + memset(&icount, 0, sizeof(struct serial_icounter_struct));
    +
    icount.cts = cnow.cts;
    icount.dsr = cnow.dsr;
    icount.rng = cnow.rng;
    --
    1.7.3.3


    \
     
     \ /
      Last update: 2011-01-02 08:59    [W:4.020 / U:0.192 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site