From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752581AbbCIUIe (ORCPT ); Mon, 9 Mar 2015 16:08:34 -0400 Received: from mail-we0-f174.google.com ([74.125.82.174]:36223 "EHLO mail-we0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752377AbbCIUIb (ORCPT ); Mon, 9 Mar 2015 16:08:31 -0400 From: Matteo Semenzato X-Google-Original-From: Matteo Semenzato To: gregkh@linuxfoundation.org, abbotti@mev.co.uk, hsweeten@visionengravers.com Cc: devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, Matteo Semenzato Subject: [PATCH] Staging: comedi: fix information leak Date: Mon, 9 Mar 2015 21:08:17 +0100 Message-Id: <1425931697-10301-1-git-send-email-mattew8898@gmail.com> X-Mailer: git-send-email 2.3.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Matteo Semenzato The comedi_cmd struct has an hole after chanlist_len that could contain uninitialized memory, this struct is copied to userspace. Signed-off-by: Matteo Semenato --- drivers/staging/comedi/comedi_fops.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c index 727640e..1cdf0a2 100644 --- a/drivers/staging/comedi/comedi_fops.c +++ b/drivers/staging/comedi/comedi_fops.c @@ -1718,6 +1718,8 @@ static int do_cmdtest_ioctl(struct comedi_device *dev, unsigned int __user *user_chanlist; int ret; + memset(&cmd, 0, sizeof(cmd)); + /* get the user's cmd and do some simple validation */ ret = __comedi_get_user_cmd(dev, arg, &cmd); if (ret) -- 2.3.2