lkml.org 
[lkml]   [2011]   [Apr]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [Stable-review] [18/74] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1
    On Wed, 2011-04-13 at 08:50 -0700, Greg KH wrote:
    > 2.6.32-longterm review patch. If anyone has any objections, please let us know.
    >
    > ------------------
    >
    > From: Dan Rosenberg <drosenberg@vsecurity.com>
    >
    > commit c4d0c3b097f7584772316ee4d64a09fe0e4ddfca upstream.
    >
    > The FSGEOMETRY_V1 ioctl (and its compat equivalent) calls out to
    > xfs_fs_geometry() with a version number of 3. This code path does not
    > fill in the logsunit member of the passed xfs_fsop_geom_t, leading to
    > the leaking of four bytes of uninitialized stack data to potentially
    > unprivileged callers.
    [...]

    This caused a serious regression and requires a second fix:

    commit af24ee9ea8d532e16883251a6684dfa1be8eec29
    Author: Alex Elder <aelder@sgi.com>
    Date: Tue Mar 1 17:50:00 2011 +0000

    xfs: zero proper structure size for geometry calls

    Ben.

    --
    Ben Hutchings
    Once a job is fouled up, anything done to improve it makes it worse.
    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2011-04-14 04:57    [W:3.974 / U:1.744 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site