]> git.karo-electronics.de Git - karo-tx-linux.git/commitdiff
xfs: prevent reading uninitialized stack memory
authorDan Rosenberg <dan.j.rosenberg@gmail.com>
Mon, 6 Sep 2010 22:24:57 +0000 (18:24 -0400)
committerGreg Kroah-Hartman <gregkh@suse.de>
Mon, 27 Sep 2010 00:21:30 +0000 (17:21 -0700)
commit a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9 upstream.

The XFS_IOC_FSGETXATTR ioctl allows unprivileged users to read 12
bytes of uninitialized stack memory, because the fsxattr struct
declared on the stack in xfs_ioc_fsgetxattr() does not alter (or zero)
the 12-byte fsx_pad member before copying it back to the user.  This
patch takes care of it.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Alex Elder <aelder@sgi.com>
Cc: dann frazier <dannf@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fs/xfs/linux-2.6/xfs_ioctl.c

index 5bb523d7f37e9263399444379f9ac16451b4dd62..98fe0db674bcad47a7d40ab673a870f7a7ea9aba 100644 (file)
@@ -789,6 +789,8 @@ xfs_ioc_fsgetxattr(
 {
        struct fsxattr          fa;
 
+       memset(&fa, 0, sizeof(struct fsxattr));
+
        xfs_ilock(ip, XFS_ILOCK_SHARED);
        fa.fsx_xflags = xfs_ip2xflags(ip);
        fa.fsx_extsize = ip->i_d.di_extsize << ip->i_mount->m_sb.sb_blocklog;