linux-kernel - [PATCH] drivers/gpu/drm/drm_ioc32.c: initialize all fields

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <1327921555-7862-2-git-send-email-Julia.Lawall@lip6.fr>
Date:	Mon, 30 Jan 2012 12:05:55 +0100
From:	Julia Lawall <Julia.Lawall@...6.fr>
To:	David Airlie <airlied@...ux.ie>
Cc:	kernel-janitors@...r.kernel.org, dri-devel@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] drivers/gpu/drm/drm_ioc32.c: initialize all fields

From: Julia Lawall <Julia.Lawall@...6.fr>

The c32 structure is allocated on the stack and its idx field is not
initialized before copying it to user level.  This patch takes the value
from the result of the ioctl, as done for the other fields.

Signed-off-by: Julia Lawall <Julia.Lawall@...6.fr>

---
An alternative would be to change the earlier code

        if (get_user(idx, &argp->idx))
                return -EFAULT;

to write into the c32 structure, rather than into the local idx variable.
This would be more similar to what is done in compat_drm_version.

 drivers/gpu/drm/drm_ioc32.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index ddd70db..637fcc3 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -315,7 +315,8 @@ static int compat_drm_getclient(struct file *file, unsigned int cmd,
 	if (err)
 		return err;
 
-	if (__get_user(c32.auth, &client->auth)
+	if (__get_user(c32.idx, &client->idx)
+	    || __get_user(c32.auth, &client->auth)
 	    || __get_user(c32.pid, &client->pid)
 	    || __get_user(c32.uid, &client->uid)
 	    || __get_user(c32.magic, &client->magic)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/