From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964807Ab3IDPlp (ORCPT ); Wed, 4 Sep 2013 11:41:45 -0400 Received: from vms173023pub.verizon.net ([206.46.173.23]:36164 "EHLO vms173023pub.verizon.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935163Ab3IDPlX (ORCPT ); Wed, 4 Sep 2013 11:41:23 -0400 X-Greylist: delayed 3602 seconds by postgrey-1.27 at vger.kernel.org; Wed, 04 Sep 2013 11:41:23 EDT From: minyard@acm.org To: Linus Torvalds Cc: Linux Kernel , OpenIPMI Developers , Dan Carpenter Subject: [PATCH 1/4] ipmi: info leak in compat_ipmi_ioctl() Date: Wed, 04 Sep 2013 09:40:41 -0500 Message-id: <1378305644-27138-2-git-send-email-minyard@acm.org> X-Mailer: git-send-email 1.7.9.5 In-reply-to: <1378305644-27138-1-git-send-email-minyard@acm.org> References: <1378305644-27138-1-git-send-email-minyard@acm.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dan Carpenter On x86_64 there is a 4 byte hole between ->recv_type and ->addr. Signed-off-by: Dan Carpenter --- drivers/char/ipmi/ipmi_devintf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c index d5a5f02..ec318bf 100644 --- a/drivers/char/ipmi/ipmi_devintf.c +++ b/drivers/char/ipmi/ipmi_devintf.c @@ -810,6 +810,7 @@ static long compat_ipmi_ioctl(struct file *filep, unsigned int cmd, struct ipmi_recv __user *precv64; struct ipmi_recv recv64; + memset(&recv64, 0, sizeof(recv64)); if (get_compat_ipmi_recv(&recv64, compat_ptr(arg))) return -EFAULT; -- 1.7.9.5