diff options
author | Vasiliy Kulikov <segooon@gmail.com> | 2010-10-26 17:22:15 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2010-10-26 19:52:11 -0400 |
commit | dae512edc6e945e127f0848aa757055265d70aa2 (patch) | |
tree | a1e903640fc4c5b9aea63004ecfd1d5ee9916e02 /drivers/char/hpet.c | |
parent | aaaddfe0b3bb449b8734bf29bbd36141076e5277 (diff) |
drivers/char/hpet.c: fix information leak to userland
Structure info is copied to userland with some padding fields unitialized.
It leads to leaking of stack memory.
[akpm@linux-foundation.org: remove now-unneeded zeroing of info->hi_ireqfreq]
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/char/hpet.c')
-rw-r--r-- | drivers/char/hpet.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c index fcb5f0d6ce70..55b8667f739f 100644 --- a/drivers/char/hpet.c +++ b/drivers/char/hpet.c | |||
@@ -596,11 +596,10 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, | |||
596 | break; | 596 | break; |
597 | case HPET_INFO: | 597 | case HPET_INFO: |
598 | { | 598 | { |
599 | memset(info, 0, sizeof(*info)); | ||
599 | if (devp->hd_ireqfreq) | 600 | if (devp->hd_ireqfreq) |
600 | info->hi_ireqfreq = | 601 | info->hi_ireqfreq = |
601 | hpet_time_div(hpetp, devp->hd_ireqfreq); | 602 | hpet_time_div(hpetp, devp->hd_ireqfreq); |
602 | else | ||
603 | info->hi_ireqfreq = 0; | ||
604 | info->hi_flags = | 603 | info->hi_flags = |
605 | readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK; | 604 | readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK; |
606 | info->hi_hpet = hpetp->hp_which; | 605 | info->hi_hpet = hpetp->hp_which; |