LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1
@ 2011-02-10 14:25 Dan Rosenberg
  2011-02-14  8:41 ` [Security] " Eugene Teo
  2011-02-14 11:46 ` Dave Chinner
  0 siblings, 2 replies; 5+ messages in thread
From: Dan Rosenberg @ 2011-02-10 14:25 UTC (permalink / raw)
  To: aelder, xfs-masters, xfs; +Cc: linux-kernel, stable, security

The FSGEOMETRY_V1 ioctl (and its compat equivalent) calls out to
xfs_fs_geometry() with a version number of 3.  This code path does not
fill in the logsunit member of the passed xfs_fsop_geom_t, leading to
the leaking of four bytes of uninitialized stack data to potentially
unprivileged callers.  Since all other members are filled in all code
paths and there are no padding bytes in this structure, it's safe to
avoid an expensive memset() in favor of just clearing this one field.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
---
 fs/xfs/xfs_fsops.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index cec89dd..17c4785 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -102,6 +102,7 @@ xfs_fs_geometry(
 				mp->m_sb.sb_logsectsize : BBSIZE;
 		geo->rtsectsize = mp->m_sb.sb_blocksize;
 		geo->dirblocksize = mp->m_dirblksize;
+		geo->logsunit = 0;
 	}
 	if (new_version >= 4) {
 		geo->flags |=



^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2011-02-14 23:39 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-02-10 14:25 [PATCH] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 Dan Rosenberg
2011-02-14  8:41 ` [Security] " Eugene Teo
2011-02-14 11:46 ` Dave Chinner
2011-02-14 13:45   ` [PATCH v2] " Dan Rosenberg
2011-02-14 23:39     ` Eugene Teo

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).