History

kernel/sys.c: avoid copying possible padding bytes in copy_to_user

Initialization is not guaranteed to zero padding bytes so use an explicit memset instead to avoid leaking any kernel content in any possible padding bytes.

Joe Perches committed 6 years ago

Commit 5e1aada1 parent ef70eff1 file · +3 −1Browse files

Unified · Split

kernel/sys.c+3−1
@@ -1279,11 +1279,13 @@ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name) · 1278 unmodified lines
1279 1279
1280SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)1280SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
1281{1281{
1282 struct oldold_utsname tmp = {};1282 struct oldold_utsname tmp;
1283 1283
1284 if (!name)1284 if (!name)
1285 return -EFAULT;1285 return -EFAULT;
1286 1286
1287 memset(&tmp, 0, sizeof(tmp));
1288
1287 down_read(&uts_sem);1289 down_read(&uts_sem);
1288 memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN);1290 memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN);
1289 memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN);1291 memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN);