diff options
| author | Jann Horn <jannh@google.com> | 2018-05-11 02:19:01 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-05-16 10:10:26 +0200 |
| commit | ef7c4825fe5fe9ed251bda8d4c04d47fe33c3afb (patch) | |
| tree | 24e3cb7999198d92daaa9e2a5b76bc47362777f7 /kernel/compat.c | |
| parent | 50ed0188af8d1a40397ff5223e54e243ab763cad (diff) | |
compat: fix 4-byte infoleak via uninitialized struct field
commit 0a0b98734479aa5b3c671d5190e86273372cab95 upstream.
Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to
native counterparts") removed the memset() in compat_get_timex(). Since
then, the compat adjtimex syscall can invoke do_adjtimex() with an
uninitialized ->tai.
If do_adjtimex() doesn't write to ->tai (e.g. because the arguments are
invalid), compat_put_timex() then copies the uninitialized ->tai field
to userspace.
Fix it by adding the memset() back.
Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel/compat.c')
| -rw-r--r-- | kernel/compat.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/compat.c b/kernel/compat.c index 772e038d04d9..7e83733d4c95 100644 --- a/kernel/compat.c +++ b/kernel/compat.c @@ -34,6 +34,7 @@ int compat_get_timex(struct timex *txc, const struct compat_timex __user *utp) { struct compat_timex tx32; + memset(txc, 0, sizeof(struct timex)); if (copy_from_user(&tx32, utp, sizeof(struct compat_timex))) return -EFAULT; |