summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorJann Horn <jannh@google.com>2018-05-11 02:19:01 +0200
committerLinus Torvalds <torvalds@linux-foundation.org>2018-05-10 17:51:58 -0700
commit0a0b98734479aa5b3c671d5190e86273372cab95 (patch)
treed5b5f0604c0cd3ea41bdcf5c1eda8793bc720129 /kernel
parent94d7dbf108813ea45a91e27e9a8bd231d5a23fa7 (diff)
downloadlinux-0a0b98734479aa5b3c671d5190e86273372cab95.tar.gz
linux-0a0b98734479aa5b3c671d5190e86273372cab95.tar.bz2
linux-0a0b98734479aa5b3c671d5190e86273372cab95.zip
compat: fix 4-byte infoleak via uninitialized struct field
Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts") removed the memset() in compat_get_timex(). Since then, the compat adjtimex syscall can invoke do_adjtimex() with an uninitialized ->tai. If do_adjtimex() doesn't write to ->tai (e.g. because the arguments are invalid), compat_put_timex() then copies the uninitialized ->tai field to userspace. Fix it by adding the memset() back. Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts") Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/compat.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/compat.c b/kernel/compat.c
index 6d21894806b4..92d8c98c0f57 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -34,6 +34,7 @@ int compat_get_timex(struct timex *txc, const struct compat_timex __user *utp)
{
struct compat_timex tx32;
+ memset(txc, 0, sizeof(struct timex));
if (copy_from_user(&tx32, utp, sizeof(struct compat_timex)))
return -EFAULT;