Skip to content

Commit 0a0b987

Browse files
thejhtorvalds
authored andcommitted
compat: fix 4-byte infoleak via uninitialized struct field
Commit 3a4d44b ("ntp: Move adjtimex related compat syscalls to native counterparts") removed the memset() in compat_get_timex(). Since then, the compat adjtimex syscall can invoke do_adjtimex() with an uninitialized ->tai. If do_adjtimex() doesn't write to ->tai (e.g. because the arguments are invalid), compat_put_timex() then copies the uninitialized ->tai field to userspace. Fix it by adding the memset() back. Fixes: 3a4d44b ("ntp: Move adjtimex related compat syscalls to native counterparts") Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 94d7dbf commit 0a0b987

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

Diff for: kernel/compat.c

+1
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ int compat_get_timex(struct timex *txc, const struct compat_timex __user *utp)
3434
{
3535
struct compat_timex tx32;
3636

37+
memset(txc, 0, sizeof(struct timex));
3738
if (copy_from_user(&tx32, utp, sizeof(struct compat_timex)))
3839
return -EFAULT;
3940

0 commit comments

Comments
 (0)