Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 30f939fe authored by Vlad Tsyrklevich's avatar Vlad Tsyrklevich Committed by Wolfram Sang
Browse files

i2c: fix kernel memory disclosure in dev interface 



i2c_smbus_xfer() does not always fill an entire block, allowing
kernel stack memory disclosure through the temp variable. Clear
it before it's read to.

Signed-off-by: default avatarVlad Tsyrklevich <vlad@tsyrklevich.net>
Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
Cc: stable@kernel.org
parent a121103c

drivers/i2c/i2c-dev.c

+1 −1
Original line number Diff line number Diff line
@@ -331,7 +331,7 @@ static noinline int i2cdev_ioctl_smbus(struct i2c_client *client, 
		unsigned long arg)

{

	struct i2c_smbus_ioctl_data data_arg;

	union i2c_smbus_data temp;

	union i2c_smbus_data temp = {};

	int datasize, res;



	if (copy_from_user(&data_arg,