Messages in this thread | | | Date | Mon, 24 Feb 2020 10:15:32 -0800 | From | Eric Biggers <> | Subject | Re: [PATCH] tty: fix compat TIOCGSERIAL leaking uninitialized memory |
| |
On Mon, Feb 24, 2020 at 09:47:26AM +0100, Jiri Slaby wrote: > On 24. 02. 20, 9:38, Eric Biggers wrote: > > From: Eric Biggers <ebiggers@google.com> > > > > Commit 77654350306a ("take compat TIOC[SG]SERIAL treatment into > > tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start > > copying a whole struct to userspace rather than individual fields, but > > failed to initialize all padding and fields -- namely the hole after the > > 'iomem_reg_shift' field, and the 'reserved' field. > > > > Fix this by initializing the struct to zero. > > > > Reported-by: syzbot+8da9175e28eadcb203ce@syzkaller.appspotmail.com > > Fixes: 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") > > Cc: <stable@vger.kernel.org> # v4.20+ > > Signed-off-by: Eric Biggers <ebiggers@google.com> > > --- > > drivers/tty/tty_io.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c > > index 1fcf7ad83dfa0..d24c250312edf 100644 > > --- a/drivers/tty/tty_io.c > > +++ b/drivers/tty/tty_io.c > > @@ -2731,6 +2731,7 @@ static int compat_tty_tiocgserial(struct tty_struct *tty, > > struct serial_struct v; > > int err; > > memset(&v, 0, sizeof(struct serial_struct)); > > + memset(&v32, 0, sizeof(struct serial_struct32)); > > sizeof(v32) please. >
Sure, I was trying to be consistent with the other line, but I'll just change them both to sizeof.
- Eric
| |