xfs-masters
[Top] [All Lists]

[PATCH] xfs: prevent reading uninitialized stack memory

To: aelder@xxxxxxx, xfs-masters@xxxxxxxxxxx
Subject: [PATCH] xfs: prevent reading uninitialized stack memory
From: Dan Rosenberg <dan.j.rosenberg@xxxxxxxxx>
Date: Mon, 6 Sep 2010 18:24:57 -0400
Cc: security@xxxxxxxxxx
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:date:message-id :subject:from:to:cc:content-type; bh=kwRMBZJz6VLiRZYQ9wkIxogJxCOzmGPQVFy6HLwtg/Y=; b=ZWS4ayaCubC89uiqwoOooCdOaEcM/vNPppI86eGN3gUpBbCDCyZlNvf/+J6roaaOxL LYPnaxgr1NWdf6pWXPBBYh1uTirsUvAkRxunzqlPuKW680CrfDoug+QtZqKCG0mLYFzK pARC3Js3084DmF3VGLC2qoSSfPOfrBlYNnPvI=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type; b=kp3/DIaRl1R9FWQY1K61OBOJV+j5DGiiSc85aXggMPCrLpw53p0bmbudWs23gSlZm9 xUrj3tmynKqo0BcAju2dj1TEQNQfbfWiMk3x8eCFXodglll38g9dOiFsRNyLR8KDiAEW gg4qm36k1JXnfXH2V+MHZpHFJnmPwSRQYsfs8=
The XFS_IOC_FSGETXATTR ioctl allows unprivileged users to read 12
bytes of uninitialized stack memory, because the fsxattr struct
declared on the stack in xfs_ioc_fsgetxattr() does not alter (or zero)
the 12-byte fsx_pad member before copying it back to the user.  This
patch takes care of it.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@xxxxxxxxx>

--- linux-2.6.35.4.orig/fs/xfs/linux-2.6/xfs_ioctl.c    2010-09-06
17:57:16.000000000 -0400
+++ linux-2.6.35.4/fs/xfs/linux-2.6/xfs_ioctl.c 2010-09-06
17:58:19.000000000 -0400
@@ -794,6 +794,8 @@ xfs_ioc_fsgetxattr(
 {
        struct fsxattr          fa;

+       memset(&fa, 0, sizeof(struct fsxattr));
+
        xfs_ilock(ip, XFS_ILOCK_SHARED);
        fa.fsx_xflags = xfs_ip2xflags(ip);
        fa.fsx_extsize = ip->i_d.di_extsize << ip->i_mount->m_sb.sb_blocklog;

<Prev in Thread] Current Thread [Next in Thread>