diff options
| author | Vasiliy Kulikov <segooon@gmail.com> | 2010-10-27 15:34:21 -0700 |
|---|---|---|
| committer | Willy Tarreau <w@1wt.eu> | 2010-12-18 14:56:33 +0100 |
| commit | 97aa7be6ee17a0966e8b8269e8c7b553134a2d82 (patch) | |
| tree | 71b3b4ac7bc38318e976b86daefeb66cc2a4fe71 | |
| parent | 75df75fb3c69000d4d07a64e673b03eabef5a521 (diff) | |
| download | linux-2.4-97aa7be6ee17a0966e8b8269e8c7b553134a2d82.tar.gz | |
drivers/char/ppdev.c: fix information leak to userland
Structure par_timeout is copied to userland with some padding fields
unitialized. Field tv_usec has type __kernel_suseconds_t, it differs from
tv_sec's type on some architectures. It leads to leaking of stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit b9b1134260e036fb75c468514569864dd6722f3e)
| -rw-r--r-- | drivers/char/ppdev.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c index 48fa4c18a3325..bbd75ed26f3b7 100644 --- a/drivers/char/ppdev.c +++ b/drivers/char/ppdev.c @@ -621,6 +621,7 @@ static int pp_ioctl(struct inode *inode, struct file *file, case PPGETTIME: to_jiffies = pp->pdev->timeout; + memset(&par_timeout, 0, sizeof(par_timeout)); par_timeout.tv_sec = to_jiffies / HZ; par_timeout.tv_usec = (to_jiffies % (long)HZ) * (1000000/HZ); if (copy_to_user ((struct timeval *)arg, &par_timeout, |