Re: [PATCH] ethtool: fix a kernel infoleak in ethtool_get_pauseparam
From: Ben Hutchings <hidden>
Date: 2016-06-01 17:14:44
Also in:
lkml
On Wed, 2016-06-01 at 16:39 +0200, Kangjie Lu wrote:
The field autoneg of pauseparam is not initialized in some implementations of get_pauseparam(),
Nonsense. The current implementation initialises all fields. (If there was padding in the structure, this change would be needed to guarantee that the padding was initialised. But there isn't.) Ben.
quoted hunk ↗ jump to hunk
but the whole object is copied to userland. Signed-off-by: Kangjie Lu <redacted> --- net/core/ethtool.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)diff --git a/net/core/ethtool.c b/net/core/ethtool.c index f426c5a..84544bd 100644 --- a/net/core/ethtool.c +++ b/net/core/ethtool.c@@ -1723,7 +1723,10 @@ static noinline_for_stack intethtool_set_channels(struct net_device *dev, static int ethtool_get_pauseparam(struct net_device *dev, void __user *useraddr) { - struct ethtool_pauseparam pauseparam = { ETHTOOL_GPAUSEPARAM }; + struct ethtool_pauseparam pauseparam; + + memset(&pauseparam, 0, sizeof(pauseparam)); + pauseparam.cmd = ETHTOOL_GPAUSEPARAM; if (!dev->ethtool_ops->get_pauseparam) return -EOPNOTSUPP;
-- Ben Hutchings To err is human; to really foul things up requires a computer.
Attachments
- signature.asc [application/pgp-signature] 819 bytes