aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/char/hpet.c
diff options
context:
space:
mode:
authorVasiliy Kulikov <segooon@gmail.com>2010-10-26 17:22:15 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2010-10-26 19:52:11 -0400
commitdae512edc6e945e127f0848aa757055265d70aa2 (patch)
treea1e903640fc4c5b9aea63004ecfd1d5ee9916e02 /drivers/char/hpet.c
parentaaaddfe0b3bb449b8734bf29bbd36141076e5277 (diff)
drivers/char/hpet.c: fix information leak to userland
Structure info is copied to userland with some padding fields unitialized. It leads to leaking of stack memory. [akpm@linux-foundation.org: remove now-unneeded zeroing of info->hi_ireqfreq] Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Cc: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/char/hpet.c')
-rw-r--r--drivers/char/hpet.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index fcb5f0d6ce70..55b8667f739f 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -596,11 +596,10 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
596 break; 596 break;
597 case HPET_INFO: 597 case HPET_INFO:
598 { 598 {
599 memset(info, 0, sizeof(*info));
599 if (devp->hd_ireqfreq) 600 if (devp->hd_ireqfreq)
600 info->hi_ireqfreq = 601 info->hi_ireqfreq =
601 hpet_time_div(hpetp, devp->hd_ireqfreq); 602 hpet_time_div(hpetp, devp->hd_ireqfreq);
602 else
603 info->hi_ireqfreq = 0;
604 info->hi_flags = 603 info->hi_flags =
605 readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK; 604 readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
606 info->hi_hpet = hpetp->hp_which; 605 info->hi_hpet = hpetp->hp_which;