[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAK8P3a3zz-xfz2jwUpEU5R7GyCK735PFQK7OjFmmTESgnSzq=Q@mail.gmail.com>
Date: Mon, 27 Jul 2020 17:35:12 +0200
From: Arnd Bergmann <arnd@...db.de>
To: Peilin Ye <yepeilin.cs@...il.com>
Cc: Stefan Richter <stefanr@...6.in-berlin.de>,
Dan Carpenter <dan.carpenter@...cle.com>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
linux-kernel-mentees@...ts.linuxfoundation.org,
linux1394-devel@...ts.sourceforge.net,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [Linux-kernel-mentees] [PATCH] firewire: Prevent kernel-infoleak
in ioctl_get_info()
On Mon, Jul 27, 2020 at 5:18 PM Peilin Ye <yepeilin.cs@...il.com> wrote:
>
> ioctl_get_info() is copying uninitialized stack memory to userspace due to
> the compiler not initializing holes in statically allocated structures.
> Fix it by initializing `event` using memset() in fill_bus_reset_event().
>
> Cc: stable@...r.kernel.org
> Suggested-by: Dan Carpenter <dan.carpenter@...cle.com>
> Suggested-by: Arnd Bergmann <arnd@...db.de>
> Signed-off-by: Peilin Ye <yepeilin.cs@...il.com>
Acked-by: Arnd Bergmann <arnd@...db.de>
I would recommend always looking through the git history of the
file to come up with an appropriate 'Fixes' tag. In this case
$ git log -p --follow drivers/firewire/core-cdev.c
searching for any mention of fill_bus_reset_event leads you to
commit 344bbc4de14e.
In my ~/.gitconfig I have this alias:
[core]
abbrev = 12
[alias]
fixes = show --format='Fixes: %h (\"%s\")' -s
With something like that, calling 'git fixes 344bbc4de14e' produces
the line to copy:
Fixes: 344bbc4de14e ("firewire: Generalize get_config_rom to get_info.")
Arnd
> ---
> drivers/firewire/core-cdev.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
> index fb6c651214f3..2341d762df5b 100644
> --- a/drivers/firewire/core-cdev.c
> +++ b/drivers/firewire/core-cdev.c
> @@ -340,6 +340,8 @@ static void fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
> {
> struct fw_card *card = client->device->card;
>
> + memset(event, 0, sizeof(*event));
> +
> spin_lock_irq(&card->lock);
>
> event->closure = client->bus_reset_closure;
> --
> 2.25.1
>
Powered by blists - more mailing lists