forked from Minki/linux
tty: fix compat TIOCGSERIAL leaking uninitialized memory
Commit7765435030
("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start copying a whole 'serial_struct32' to userspace rather than individual fields, but failed to initialize all padding and fields -- namely the hole after the 'iomem_reg_shift' field, and the 'reserved' field. Fix this by initializing the struct to zero. [v2: use sizeof, and convert the adjacent line for consistency.] Reported-by: syzbot+8da9175e28eadcb203ce@syzkaller.appspotmail.com Fixes:7765435030
("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") Cc: <stable@vger.kernel.org> # v4.20+ Signed-off-by: Eric Biggers <ebiggers@google.com> Acked-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20200224182044.234553-2-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
ed069827ca
commit
17329563a9
@ -2730,7 +2730,9 @@ static int compat_tty_tiocgserial(struct tty_struct *tty,
|
||||
struct serial_struct32 v32;
|
||||
struct serial_struct v;
|
||||
int err;
|
||||
memset(&v, 0, sizeof(struct serial_struct));
|
||||
|
||||
memset(&v, 0, sizeof(v));
|
||||
memset(&v32, 0, sizeof(v32));
|
||||
|
||||
if (!tty->ops->set_serial)
|
||||
return -ENOTTY;
|
||||
|
Loading…
Reference in New Issue
Block a user