| From 03145beb455cf5c20a761e8451e30b8a74ba58d9 Mon Sep 17 00:00:00 2001 |
| From: Dan Rosenberg <drosenberg@vsecurity.com> |
| Date: Wed, 27 Oct 2010 15:34:17 -0700 |
| Subject: ipc: initialize structure memory to zero for compat functions |
| |
| From: Dan Rosenberg <drosenberg@vsecurity.com> |
| |
| commit 03145beb455cf5c20a761e8451e30b8a74ba58d9 upstream. |
| |
| This takes care of leaking uninitialized kernel stack memory to |
| userspace from non-zeroed fields in structs in compat ipc functions. |
| |
| Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> |
| Cc: Manfred Spraul <manfred@colorfullife.com> |
| Cc: Arnd Bergmann <arnd@arndb.de> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| ipc/compat.c | 6 ++++++ |
| ipc/compat_mq.c | 5 +++++ |
| 2 files changed, 11 insertions(+) |
| |
| --- a/ipc/compat.c |
| +++ b/ipc/compat.c |
| @@ -242,6 +242,8 @@ long compat_sys_semctl(int first, int se |
| struct semid64_ds __user *up64; |
| int version = compat_ipc_parse_version(&third); |
| |
| + memset(&s64, 0, sizeof(s64)); |
| + |
| if (!uptr) |
| return -EINVAL; |
| if (get_user(pad, (u32 __user *) uptr)) |
| @@ -422,6 +424,8 @@ long compat_sys_msgctl(int first, int se |
| int version = compat_ipc_parse_version(&second); |
| void __user *p; |
| |
| + memset(&m64, 0, sizeof(m64)); |
| + |
| switch (second & (~IPC_64)) { |
| case IPC_INFO: |
| case IPC_RMID: |
| @@ -595,6 +599,8 @@ long compat_sys_shmctl(int first, int se |
| int err, err2; |
| int version = compat_ipc_parse_version(&second); |
| |
| + memset(&s64, 0, sizeof(s64)); |
| + |
| switch (second & (~IPC_64)) { |
| case IPC_RMID: |
| case SHM_LOCK: |
| --- a/ipc/compat_mq.c |
| +++ b/ipc/compat_mq.c |
| @@ -53,6 +53,9 @@ asmlinkage long compat_sys_mq_open(const |
| void __user *p = NULL; |
| if (u_attr && oflag & O_CREAT) { |
| struct mq_attr attr; |
| + |
| + memset(&attr, 0, sizeof(attr)); |
| + |
| p = compat_alloc_user_space(sizeof(attr)); |
| if (get_compat_mq_attr(&attr, u_attr) || |
| copy_to_user(p, &attr, sizeof(attr))) |
| @@ -127,6 +130,8 @@ asmlinkage long compat_sys_mq_getsetattr |
| struct mq_attr __user *p = compat_alloc_user_space(2 * sizeof(*p)); |
| long ret; |
| |
| + memset(&mqstat, 0, sizeof(mqstat)); |
| + |
| if (u_mqstat) { |
| if (get_compat_mq_attr(&mqstat, u_mqstat) || |
| copy_to_user(p, &mqstat, sizeof(mqstat))) |