[PATCH] drivers/net/eql.c: prevent reading uninitialized stack memory

[Dan Rosenberg]

The EQL_GETMASTRCFG device ioctl allows unprivileged users to read 16
bytes of uninitialized stack memory, because the "master_name" member
of the master_config_t struct declared on the stack in
eql_g_master_cfg() is not altered or zeroed before being copied back
to the user.  This patch takes care of it.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@xxxxxxxxx>

--- linux-2.6.35.4.orig/drivers/net/eql.c	2010-09-11 19:13:04.000000000 -0400
+++ linux-2.6.35.4/drivers/net/eql.c	2010-09-11 19:17:55.000000000 -0400
@@ -555,6 +555,8 @@ static int eql_g_master_cfg(struct net_d
 	equalizer_t *eql;
 	master_config_t mc;

+	memset(&mc, 0, sizeof(master_config_t));
+
 	if (eql_is_master(dev)) {
 		eql = netdev_priv(dev);
 		mc.max_slaves = eql->max_slaves;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/