Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 627aad1c authored by Dan Carpenter's avatar Dan Carpenter Committed by Linus Torvalds
Browse files

cpqarray: fix info leak in ida_locked_ioctl() 



The pciinfo struct has a two byte hole after ->dev_fn so stack
information could be leaked to the user.

This was assigned CVE-2013-2147.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarMike Miller <mike.miller@hp.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent e2f0b88e

drivers/block/cpqarray.c

+1 −0
Original line number Diff line number Diff line
@@ -1193,6 +1193,7 @@ out_passthru: 
		ida_pci_info_struct pciinfo;



		if (!arg) return -EINVAL;

		memset(&pciinfo, 0, sizeof(pciinfo));

		pciinfo.bus = host->pci_dev->bus->number;

		pciinfo.dev_fn = host->pci_dev->devfn;

		pciinfo.board_id = host->board_id;