diff options
| author | Vasiliy Kulikov <segooon@gmail.com> | 2010-11-08 14:42:40 +0100 |
|---|---|---|
| committer | Jens Axboe <jaxboe@fusionio.com> | 2010-11-10 14:40:53 +0100 |
| commit | a014741c0adfb8fb79952939ca087cf03d272bb9 (patch) | |
| tree | 57bafa05736f172b94fde156bb51798b3ddb6107 /block | |
| parent | 77304d2abac6101f7249754ffdd4421258877ab0 (diff) | |
| download | lwn-a014741c0adfb8fb79952939ca087cf03d272bb9.tar.gz lwn-a014741c0adfb8fb79952939ca087cf03d272bb9.zip | |
block: ioctl: fix information leak to userland
Structure hd_geometry is copied to userland with 4 padding bytes
between cylinders and start fields uninitialized on 64-bit platforms.
It leads to leaking of contents of kernel stack memory.
Currently there is no memset() in real implementations of getgeo()
in drivers/block/, so it makes sense to have memset() in blkdev_ioctl().
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/ioctl.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/block/ioctl.c b/block/ioctl.c index 38aa194f63ec..3d866d0037f2 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -242,6 +242,7 @@ int blkdev_ioctl(struct block_device *bdev, fmode_t mode, unsigned cmd, * We need to set the startsect first, the driver may * want to override it. */ + memset(&geo, 0, sizeof(geo)); geo.start = get_start_sect(bdev); ret = disk->fops->getgeo(bdev, &geo); if (ret) |