diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-11-01 13:21:54 +0300 |
|---|---|---|
| committer | Jan Kara <jack@suse.cz> | 2013-11-04 14:16:55 +0100 |
| commit | 18da65e7d30a76ab3ca0ccd2b7ca0690f80f28e4 (patch) | |
| tree | 007299bae59b813451ae918e3ab5cdc2486c1494 /fs/quota | |
| parent | 1ce0aa802c4cbe6dfe2c7fa95c839d75a509c9a5 (diff) | |
| download | op-kernel-dev-18da65e7d30a76ab3ca0ccd2b7ca0690f80f28e4.zip op-kernel-dev-18da65e7d30a76ab3ca0ccd2b7ca0690f80f28e4.tar.gz | |
quota: info leak in quota_getquota()
The if_dqblk struct has a 4 byte hole at the end of the struct so
uninitialized stack information is leaked to user space.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/quota')
| -rw-r--r-- | fs/quota/quota.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/quota/quota.c b/fs/quota/quota.c index dea86e8..2b363e2 100644 --- a/fs/quota/quota.c +++ b/fs/quota/quota.c @@ -117,6 +117,7 @@ static int quota_setinfo(struct super_block *sb, int type, void __user *addr) static void copy_to_if_dqblk(struct if_dqblk *dst, struct fs_disk_quota *src) { + memset(dst, 0, sizeof(*dst)); dst->dqb_bhardlimit = src->d_blk_hardlimit; dst->dqb_bsoftlimit = src->d_blk_softlimit; dst->dqb_curspace = src->d_bcount; |
