Messages in this thread Patch in this message | | | From | Peilin Ye <> | Subject | [Linux-kernel-mentees] [PATCH] scsi/megaraid: Prevent kernel-infoleak in kioc_to_mimd() | Date | Mon, 27 Jul 2020 17:02:35 -0400 |
| |
hinfo_to_cinfo() does no operation on `cinfo` when `hinfo` is NULL, causing kioc_to_mimd() to copy uninitialized stack memory to userspace. Fix it by initializing `cinfo` with memset().
Cc: stable@vger.kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Suggested-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com> --- drivers/scsi/megaraid/megaraid_mm.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c index 8df53446641a..9df0e6b253a8 100644 --- a/drivers/scsi/megaraid/megaraid_mm.c +++ b/drivers/scsi/megaraid/megaraid_mm.c @@ -816,6 +816,8 @@ kioc_to_mimd(uioc_t *kioc, mimd_t __user *mimd) case MEGAIOC_QADAPINFO: + memset(&cinfo, 0, sizeof(cinfo)); + hinfo = (mraid_hba_info_t *)(unsigned long) kioc->buf_vaddr; -- 2.25.1
| |