diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-09-05 13:36:33 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-09-05 17:34:31 +0200 |
| commit | fa7df37b588f48a1ff6ef005187f3c5c2281df95 (patch) | |
| tree | 6b5935ec2a8977b219009d6438c61906abbd9164 /drivers/char/ipmi/ipmi_devintf.c | |
| parent | Linux 3.11 (diff) | |
| download | linux-fa7df37b588f48a1ff6ef005187f3c5c2281df95.tar.xz linux-fa7df37b588f48a1ff6ef005187f3c5c2281df95.zip | |
ipmi: info leak in compat_ipmi_ioctl()
On x86_64 there is a 4 byte hole between ->recv_type and ->addr.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/char/ipmi/ipmi_devintf.c')
| -rw-r--r-- | drivers/char/ipmi/ipmi_devintf.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c index d5a5f020810a..ec318bf434a6 100644 --- a/drivers/char/ipmi/ipmi_devintf.c +++ b/drivers/char/ipmi/ipmi_devintf.c @@ -810,6 +810,7 @@ static long compat_ipmi_ioctl(struct file *filep, unsigned int cmd, struct ipmi_recv __user *precv64; struct ipmi_recv recv64; + memset(&recv64, 0, sizeof(recv64)); if (get_compat_ipmi_recv(&recv64, compat_ptr(arg))) return -EFAULT; |