]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
compat: fix 4-byte infoleak via uninitialized struct field
authorJann Horn <jannh@google.com>
Fri, 11 May 2018 00:19:01 +0000 (02:19 +0200)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 11 May 2018 00:51:58 +0000 (17:51 -0700)
Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to
native counterparts") removed the memset() in compat_get_timex().  Since
then, the compat adjtimex syscall can invoke do_adjtimex() with an
uninitialized ->tai.

If do_adjtimex() doesn't write to ->tai (e.g.  because the arguments are
invalid), compat_put_timex() then copies the uninitialized ->tai field
to userspace.

Fix it by adding the memset() back.

Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
kernel/compat.c

index 6d21894806b46f6a4a2aa7e2d2a9f43c324ca1d8..92d8c98c0f57ac92aacd888d9342debcdec46cdb 100644 (file)
@@ -34,6 +34,7 @@ int compat_get_timex(struct timex *txc, const struct compat_timex __user *utp)
 {
        struct compat_timex tx32;
 
+       memset(txc, 0, sizeof(struct timex));
        if (copy_from_user(&tx32, utp, sizeof(struct compat_timex)))
                return -EFAULT;