From: sohu0106 <sohu0106@126.com>
To: linux-fbdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, torvalds@linux-foundation.org
Subject: driver/video/fbdev/aty/atyfb_base.c: atyfb_ioctl() stack infoleak
Date: Thu, 3 Aug 2017 22:01:40 +0800 (CST) [thread overview]
Message-ID: <592b793c.aa4f.15da866df61.Coremail.sohu0106@126.com> (raw)
driver/video/fbdev/aty/atyfb_base.c
In atyfb_ioctl() structure atyclk is copied to userland with padding bytes after "vclk_post_div" field unitialized. It leads to leaking of contents of kernel stack memory.
3 drivers/video/fbdev/aty/atyfb_base.c
@@ -1857,6 +1857,9 @@ static int atyfb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
if (M64_HAS(INTEGRATED)) {
struct atyclk clk;
union aty_pll *pll = &par->pll;
+
+ memset( &clk, 0, sizeof(struct atyclk) );
+
u32 dsp_config = pll->ct.dsp_config;
u32 dsp_on_off = pll->ct.dsp_on_off;
clk.ref_clk_per = par->ref_clk_per;
reply other threads:[~2017-08-03 14:02 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=592b793c.aa4f.15da866df61.Coremail.sohu0106@126.com \
--to=sohu0106@126.com \
--cc=linux-fbdev@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®