Commit 2145e15e authored Apr 28, 2014 by Matthew Daley Committed by Linus Torvalds May 05, 2014

floppy: don't write kernel-only members to FDRAWCMD ioctl output



Do not leak kernel-only floppy_raw_cmd structure members to userspace.
This includes the linked-list pointer and the pointer to the allocated
DMA space.

Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent ef87dbe7

drivers/block/floppy.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -3067,7 +3067,10 @@ static int raw_cmd_copyout(int cmd, void __user *param,
		int ret;

		while (ptr) {
		ret = copy_to_user(param, ptr, sizeof(*ptr));
		struct floppy_raw_cmd cmd = *ptr;
		cmd.next = NULL;
		cmd.kernel_data = NULL;
		ret = copy_to_user(param, &cmd, sizeof(cmd));
		if (ret)
		return -EFAULT;
		param += sizeof(struct floppy_raw_cmd);