Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 03145beb authored by Dan Rosenberg's avatar Dan Rosenberg Committed by Linus Torvalds
Browse files

ipc: initialize structure memory to zero for compat functions 



This takes care of leaking uninitialized kernel stack memory to
userspace from non-zeroed fields in structs in compat ipc functions.

Signed-off-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: <stable@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent b7952180

ipc/compat.c

+6 −0
Original line number Diff line number Diff line
@@ -241,6 +241,8 @@ long compat_sys_semctl(int first, int second, int third, void __user *uptr) 
	struct semid64_ds __user *up64;

	int version = compat_ipc_parse_version(&third);



	memset(&s64, 0, sizeof(s64));



	if (!uptr)

		return -EINVAL;

	if (get_user(pad, (u32 __user *) uptr))
@@ -421,6 +423,8 @@ long compat_sys_msgctl(int first, int second, void __user *uptr) 
	int version = compat_ipc_parse_version(&second);

	void __user *p;



	memset(&m64, 0, sizeof(m64));



	switch (second & (~IPC_64)) {

	case IPC_INFO:

	case IPC_RMID:
@@ -594,6 +598,8 @@ long compat_sys_shmctl(int first, int second, void __user *uptr) 
	int err, err2;

	int version = compat_ipc_parse_version(&second);



	memset(&s64, 0, sizeof(s64));



	switch (second & (~IPC_64)) {

	case IPC_RMID:

	case SHM_LOCK:

ipc/compat_mq.c

+5 −0
Original line number Diff line number Diff line
@@ -53,6 +53,9 @@ asmlinkage long compat_sys_mq_open(const char __user *u_name, 
	void __user *p = NULL;

	if (u_attr && oflag & O_CREAT) {

		struct mq_attr attr;



		memset(&attr, 0, sizeof(attr));



		p = compat_alloc_user_space(sizeof(attr));

		if (get_compat_mq_attr(&attr, u_attr) ||

		    copy_to_user(p, &attr, sizeof(attr)))
@@ -127,6 +130,8 @@ asmlinkage long compat_sys_mq_getsetattr(mqd_t mqdes, 
	struct mq_attr __user *p = compat_alloc_user_space(2 * sizeof(*p));

	long ret;



	memset(&mqstat, 0, sizeof(mqstat));



	if (u_mqstat) {

		if (get_compat_mq_attr(&mqstat, u_mqstat) ||

		    copy_to_user(p, &mqstat, sizeof(mqstat)))