From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753986Ab1BNXj7 (ORCPT ); Mon, 14 Feb 2011 18:39:59 -0500 Received: from mail-yw0-f46.google.com ([209.85.213.46]:39736 "EHLO mail-yw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753942Ab1BNXjz convert rfc822-to-8bit (ORCPT ); Mon, 14 Feb 2011 18:39:55 -0500 MIME-Version: 1.0 In-Reply-To: <1297691128.1857.4.camel@dan> References: <1297347904.13370.9.camel@dan> <20110214114629.GA13052@dastard> <1297691128.1857.4.camel@dan> Date: Tue, 15 Feb 2011 07:39:53 +0800 Message-ID: Subject: Re: [PATCH v2] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 From: Eugene Teo To: Dan Rosenberg Cc: Dave Chinner , aelder@sgi.com, xfs-masters@oss.sgi.com, xfs@oss.sgi.com, linux-kernel@vger.kernel.org, stable@kernel.org, security@kernel.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Feb 14, 2011 at 9:45 PM, Dan Rosenberg wrote: > The FSGEOMETRY_V1 ioctl (and its compat equivalent) calls out to > xfs_fs_geometry() with a version number of 3.  This code path does not > fill in the logsunit member of the passed xfs_fsop_geom_t, leading to > the leaking of four bytes of uninitialized stack data to potentially > unprivileged callers. > > v2 switches to memset() to avoid future issues if structure members > change, on suggestion of Dave Chinner. > > Signed-off-by: Dan Rosenberg Reviewed-by: Eugene Teo > --- >  fs/xfs/xfs_fsops.c |    3 +++ >  1 files changed, 3 insertions(+), 0 deletions(-) > > diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c > index cec89dd..85668ef 100644 > --- a/fs/xfs/xfs_fsops.c > +++ b/fs/xfs/xfs_fsops.c > @@ -53,6 +53,9 @@ xfs_fs_geometry( >        xfs_fsop_geom_t         *geo, >        int                     new_version) >  { > + > +       memset(geo, 0, sizeof(*geo)); > + >        geo->blocksize = mp->m_sb.sb_blocksize; >        geo->rtextsize = mp->m_sb.sb_rextsize; >        geo->agblocks = mp->m_sb.sb_agblocks; > > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at  http://vger.kernel.org/majordomo-info.html > Please read the FAQ at  http://www.tux.org/lkml/ > From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from cuda.sgi.com (cuda1.sgi.com [192.48.157.11]) by oss.sgi.com (8.14.3/8.14.3/SuSE Linux 0.8) with ESMTP id p1ENbILQ162913 for ; Mon, 14 Feb 2011 17:37:19 -0600 MIME-Version: 1.0 In-Reply-To: <1297691128.1857.4.camel@dan> References: <1297347904.13370.9.camel@dan> <20110214114629.GA13052@dastard> <1297691128.1857.4.camel@dan> Date: Tue, 15 Feb 2011 07:39:53 +0800 Message-ID: Subject: Re: [PATCH v2] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 From: Eugene Teo List-Id: XFS Filesystem from SGI List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: xfs-bounces@oss.sgi.com Errors-To: xfs-bounces@oss.sgi.com To: Dan Rosenberg Cc: security@kernel.org, linux-kernel@vger.kernel.org, xfs@oss.sgi.com, xfs-masters@oss.sgi.com, aelder@sgi.com, stable@kernel.org On Mon, Feb 14, 2011 at 9:45 PM, Dan Rosenberg w= rote: > The FSGEOMETRY_V1 ioctl (and its compat equivalent) calls out to > xfs_fs_geometry() with a version number of 3. =A0This code path does not > fill in the logsunit member of the passed xfs_fsop_geom_t, leading to > the leaking of four bytes of uninitialized stack data to potentially > unprivileged callers. > > v2 switches to memset() to avoid future issues if structure members > change, on suggestion of Dave Chinner. > > Signed-off-by: Dan Rosenberg Reviewed-by: Eugene Teo > --- > =A0fs/xfs/xfs_fsops.c | =A0 =A03 +++ > =A01 files changed, 3 insertions(+), 0 deletions(-) > > diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c > index cec89dd..85668ef 100644 > --- a/fs/xfs/xfs_fsops.c > +++ b/fs/xfs/xfs_fsops.c > @@ -53,6 +53,9 @@ xfs_fs_geometry( > =A0 =A0 =A0 =A0xfs_fsop_geom_t =A0 =A0 =A0 =A0 *geo, > =A0 =A0 =A0 =A0int =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 new_version) > =A0{ > + > + =A0 =A0 =A0 memset(geo, 0, sizeof(*geo)); > + > =A0 =A0 =A0 =A0geo->blocksize =3D mp->m_sb.sb_blocksize; > =A0 =A0 =A0 =A0geo->rtextsize =3D mp->m_sb.sb_rextsize; > =A0 =A0 =A0 =A0geo->agblocks =3D mp->m_sb.sb_agblocks; > > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at =A0http://vger.kernel.org/majordomo-info.html > Please read the FAQ at =A0http://www.tux.org/lkml/ > _______________________________________________ xfs mailing list xfs@oss.sgi.com http://oss.sgi.com/mailman/listinfo/xfs