Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2516ffac authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging/ozwpan: info leak in oz_cdev_ioctl() 



If we're not maxed out then oz_get_pd_list() leaves part of the "list"
struct uninitialized.  We should clear this so that no stack information
is leaked to userspace.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent eecb2629

drivers/staging/ozwpan/ozcdev.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -253,6 +253,7 @@ static long oz_cdev_ioctl(struct file *filp, unsigned int cmd, 
	case OZ_IOCTL_GET_PD_LIST: {

	case OZ_IOCTL_GET_PD_LIST: {

			struct oz_pd_list list;

			struct oz_pd_list list;

			oz_trace("OZ_IOCTL_GET_PD_LIST\n");

			oz_trace("OZ_IOCTL_GET_PD_LIST\n");

			memset(&list, 0, sizeof(list));

			list.count = oz_get_pd_list(list.addr, OZ_MAX_PDS);

			list.count = oz_get_pd_list(list.addr, OZ_MAX_PDS);

			if (copy_to_user((void __user *)arg, &list,

			if (copy_to_user((void __user *)arg, &list,

				sizeof(list)))

				sizeof(list)))