Commit a0c5a394 authored by Vasiliy Kulikov's avatar Vasiliy Kulikov Committed by David Woodhouse
Browse files

mtd: mtdchar: fix information leak to userland 



Structure mtd_info_user is copied to userland with padding byted
between "type" and "flags" fields uninitialized.  It leads to leaking
of contents of kernel stack memory.

Signed-off-by: default avatarVasiliy Kulikov <segooon@gmail.com>
Signed-off-by: default avatarArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
parent ac80dac0

drivers/mtd/mtdchar.c

+1 −1
Original line number Diff line number Diff line
@@ -601,6 +601,7 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg) 
	}



	case MEMGETINFO:

		memset(&info, 0, sizeof(info));

		info.type	= mtd->type;

		info.flags	= mtd->flags;

		info.size	= mtd->size;
@@ -609,7 +610,6 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg) 
		info.oobsize	= mtd->oobsize;

		/* The below fields are obsolete */

		info.ecctype	= -1;

		info.eccsize	= 0;

		if (copy_to_user(argp, &info, sizeof(struct mtd_info_user)))

			return -EFAULT;

		break;

CRA Git | Maintained and supported by SUSTech CRA and CCSE