Messages in this thread | | | Date | Thu, 5 Oct 2023 19:55:34 +0200 | From | Greg Kroah-Hartman <> | Subject | Re: stack leak via uart_get_info() ? |
| |
On Thu, Oct 05, 2023 at 07:34:21PM +0300, Alexey Dobriyan wrote: > If this check ever triggers > > static int uart_get_info(struct tty_port *port, struct serial_struct *retinfo) > { > > uport = uart_port_check(state); > if (!uport) > goto out; > > then all those sysfs users will print stack contents to userspace. > > Can it trigger while sysfs read is executing?
I don't think it can ever fail, we don't even check the result in other places, so it should all be fine.
> Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> > --- > > --- a/drivers/tty/serial/serial_core.c > +++ b/drivers/tty/serial/serial_core.c > @@ -775,6 +775,8 @@ static int uart_get_info(struct tty_port *port, struct serial_struct *retinfo) > struct uart_port *uport; > int ret = -ENODEV; > > + *retinfo = (struct serial_struct){};
This is good (although I hate the implied memcpy), a real memset would be best to ensure that any holes are also filled. Want to do that, or want me to?
thanks,
greg k-h
| |