diff options
| author | Vasiliy Kulikov <segooon@gmail.com> | 2010-10-26 14:22:15 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2010-10-26 16:52:11 -0700 |
| commit | dae512edc6e945e127f0848aa757055265d70aa2 (patch) | |
| tree | a1e903640fc4c5b9aea63004ecfd1d5ee9916e02 | |
| parent | aaaddfe0b3bb449b8734bf29bbd36141076e5277 (diff) | |
| download | linux-dae512edc6e945e127f0848aa757055265d70aa2.tar.bz2 | |
drivers/char/hpet.c: fix information leak to userland
Structure info is copied to userland with some padding fields unitialized.
It leads to leaking of stack memory.
[akpm@linux-foundation.org: remove now-unneeded zeroing of info->hi_ireqfreq]
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | drivers/char/hpet.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c index fcb5f0d6ce70..55b8667f739f 100644 --- a/drivers/char/hpet.c +++ b/drivers/char/hpet.c @@ -596,11 +596,10 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, break; case HPET_INFO: { + memset(info, 0, sizeof(*info)); if (devp->hd_ireqfreq) info->hi_ireqfreq = hpet_time_div(hpetp, devp->hd_ireqfreq); - else - info->hi_ireqfreq = 0; info->hi_flags = readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK; info->hi_hpet = hpetp->hp_which; |