diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-05-03 23:27:00 +0300 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2014-05-05 10:33:28 +1000 |
| commit | 3cf0b0311e746a26dcc7c0b5ba0756f61d636a33 (patch) | |
| tree | b58c36fa7eb6ca75c233db097b4b951619634b03 | |
| parent | 0384dcae2b18db80c49117ac57ea15211ca48751 (diff) | |
| download | op-kernel-dev-3cf0b0311e746a26dcc7c0b5ba0756f61d636a33.zip op-kernel-dev-3cf0b0311e746a26dcc7c0b5ba0756f61d636a33.tar.gz | |
agp: info leak in agpioc_info_wrap()
On 64 bit systems the agp_info struct has a 4 byte hole between
->agp_mode and ->aper_base. We need to clear it to avoid disclosing
stack information to userspace.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
| -rw-r--r-- | drivers/char/agp/frontend.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c index 8121b4c..b297033 100644 --- a/drivers/char/agp/frontend.c +++ b/drivers/char/agp/frontend.c @@ -730,6 +730,7 @@ static int agpioc_info_wrap(struct agp_file_private *priv, void __user *arg) agp_copy_info(agp_bridge, &kerninfo); + memset(&userinfo, 0, sizeof(userinfo)); userinfo.version.major = kerninfo.version.major; userinfo.version.minor = kerninfo.version.minor; userinfo.bridge_id = kerninfo.device->vendor | |
