summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVasiliy Kulikov <segooon@gmail.com>2010-10-26 14:22:15 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2010-10-26 16:52:11 -0700
commitdae512edc6e945e127f0848aa757055265d70aa2 (patch)
treea1e903640fc4c5b9aea63004ecfd1d5ee9916e02
parentaaaddfe0b3bb449b8734bf29bbd36141076e5277 (diff)
drivers/char/hpet.c: fix information leak to userland
Structure info is copied to userland with some padding fields unitialized. It leads to leaking of stack memory. [akpm@linux-foundation.org: remove now-unneeded zeroing of info->hi_ireqfreq] Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Cc: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/char/hpet.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index fcb5f0d6ce70..55b8667f739f 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -596,11 +596,10 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
break;
case HPET_INFO:
{
+ memset(info, 0, sizeof(*info));
if (devp->hd_ireqfreq)
info->hi_ireqfreq =
hpet_time_div(hpetp, devp->hd_ireqfreq);
- else
- info->hi_ireqfreq = 0;
info->hi_flags =
readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
info->hi_hpet = hpetp->hp_which;