p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

IEEE 1394 (FireWire) subsystem fix: The character device file interface for 

raw 1394 I/O took uninitialized kernel stack as substitute for missing ioctl()
 argument data.  This could partially show up in subsequent read() output.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJUZeaiAAoJEHnzb7JUXXnQQWsP/2j9wJoAzHJ5F107djEvoBa9
 6Ieg7n9AhVB3c6gLI2ot8LDsGJtaOaZ3VYCvqNmYn1zNHqKsTtbhskZNKeI8Qzya
 5sxHsSFgO2A403kAejybNWz+KYK87/ytl7Y22x/+qdDLwSg04fIlZHc+K4hRdiDx
 Oo4x7TFTqbms/SYD/f1zEKCg/Osxhp0pxeK/LDRc82QmG1Bt5daP5NG5PjqVvilS
 itOSwYgFj0SCd6Fbx/j9eU271f8qNxBOMaKJoONrKN9Akuz2al29BP7GysEoA1wV
 YYieCXm5EDEFgydrMKXPhoK5NCSnIwk5g+pKLD/EEqj6Dc59VaBLqrJzHdzcERY/
 spyluifSqX53QlZ+v5NAhtDNWWtJajXRzrm/r9kmX9utmNlAPXKesduw+UHdj0qy
 EgtZ0SMvELuh0IfyewjFu9MzwgDDoobO7zH0s3+nvZU60jGJn0DWPu0QNCuWKsCB
 Pz/uyQy6MKfrZxQZAimVpR7ktm9AXiyJ5bxgKiWdPX0txAe1mpbsyP/0jgieZNXy
 szYTHci8gVm/lm3yZsxX+WpXDZNP9/VXpy/6tfKsB+hhvca/XdmicmHl6ilZ9F0t
 r69IhJ2EeUgrM6TkT59PylB5/iCnxF/cML7a2no7TCTn0AiFbgrJY6tXRMZAyYUC
 k+4nL9nOZEL1+HQya2pi
 =mycw
 -----END PGP SIGNATURE-----

Merge tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull firewire fix from Stefan Richter:
 "IEEE 1394 (FireWire) subsystem fix: The character device file
  interface for raw 1394 I/O took uninitialized kernel stack as
  substitute for missing ioctl() argument data.  This could partially
  show up in subsequent read() output"

* tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: cdev: prevent kernel stack leaking into ioctl arguments
This commit is contained in:
Linus Torvalds 2014-11-14 12:44:48 -08:00
parent 3865efcb14 eaca2d8e75
commit f720d7df99
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/firewire/core-cdev.c
View File

@ -1637,8 +1637,7 @@ static int dispatch_ioctl(struct client *client,
_IOC_SIZE(cmd) > sizeof(buffer))
return -ENOTTY;
if (_IOC_DIR(cmd) == _IOC_READ)
memset(&buffer, 0, _IOC_SIZE(cmd));
memset(&buffer, 0, sizeof(buffer));
if (_IOC_DIR(cmd) & _IOC_WRITE)
if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))