Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a0c5a394 authored Nov 06, 2010 by Vasiliy Kulikov Committed by David Woodhouse Dec 03, 2010

mtd: mtdchar: fix information leak to userland



Structure mtd_info_user is copied to userland with padding byted
between "type" and "flags" fields uninitialized.  It leads to leaking
of contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

parent ac80dac0

drivers/mtd/mtdchar.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -601,6 +601,7 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
		}

		case MEMGETINFO:
		memset(&info, 0, sizeof(info));
		info.type = mtd->type;
		info.flags = mtd->flags;
		info.size = mtd->size;
		@@ -609,7 +610,6 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
		info.oobsize = mtd->oobsize;
		/* The below fields are obsolete */
		info.ecctype = -1;
		info.eccsize = 0;
		if (copy_to_user(argp, &info, sizeof(struct mtd_info_user)))
		return -EFAULT;
		break;