| From 24bd3efc9d1efb5f756a7c6f807a36ddb6adc671 Mon Sep 17 00:00:00 2001 |
| From: Linus Walleij <linus.walleij@linaro.org> |
| Date: Mon, 22 Jan 2018 13:19:28 +0100 |
| Subject: gpio: Fix kernel stack leak to userspace |
| |
| From: Linus Walleij <linus.walleij@linaro.org> |
| |
| commit 24bd3efc9d1efb5f756a7c6f807a36ddb6adc671 upstream. |
| |
| The GPIO event descriptor was leaking kernel stack to |
| userspace because we don't zero the variable before |
| use. Ooops. Fix this. |
| |
| Reported-by: Arnd Bergmann <arnd@arndb.de> |
| Reviewed-by: Bartosz Golaszewski <brgl@bgdev.pl> |
| Reviewed-by: Arnd Bergmann <arnd@arndb.de> |
| Signed-off-by: Linus Walleij <linus.walleij@linaro.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/gpio/gpiolib.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/drivers/gpio/gpiolib.c |
| +++ b/drivers/gpio/gpiolib.c |
| @@ -723,6 +723,9 @@ static irqreturn_t lineevent_irq_thread( |
| struct gpioevent_data ge; |
| int ret, level; |
| |
| + /* Do not leak kernel stack to userspace */ |
| + memset(&ge, 0, sizeof(ge)); |
| + |
| ge.timestamp = ktime_get_real_ns(); |
| level = gpiod_get_value_cansleep(le->desc); |
| |
