Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753438Ab3EMKSm (ORCPT ); Mon, 13 May 2013 06:18:42 -0400 Received: from cantor2.suse.de ([195.135.220.15]:58401 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752707Ab3EMKSl (ORCPT ); Mon, 13 May 2013 06:18:41 -0400 Date: Mon, 13 May 2013 12:18:39 +0200 From: Jan Kara To: Cong Wang Cc: linux-kernel@vger.kernel.org, Andrew Morton , Jan Kara , xfs@oss.sgi.com Subject: Re: [Patch] quota: do not leak info to user-space Message-ID: <20130513101839.GE400@quack.suse.cz> References: <1368177873-4819-1-git-send-email-amwang@redhat.com> <20130513100423.GD400@quack.suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20130513100423.GD400@quack.suse.cz> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1867 Lines: 49 On Mon 13-05-13 12:04:23, Jan Kara wrote: > On Fri 10-05-13 17:24:33, Cong Wang wrote: > > From: Cong Wang > > > > There is a hole in struct fs_quota_stat, so we have to > > zero the struct on stack before copying it to user-space. > > > > Cc: Jan Kara > > Signed-off-by: Cong Wang > Good point. I've merged the patch. Ah, now I've noticed that XFS (the only user of the callback you are fixing) is zeroing the structure on its own (xfs_qm_scall_getqstat). So there's no real problem. I'm somewhat wondering whether clearing the field in the place where you did it isn't more future-proof but usually we don't pass in prezeroed buffers so I've decided to leave things as they are. Honza > BTW for XFS folks: The structure definition looks somewhat odd (unaligned > definition of qs_flags, qs_uquota starts only at 32-bit boundary although > it has 64-bit fields in it) and I wouldn't be surprised if it needed compat > wrapper for 32-bit apps on some architectures... > > Honza > > > > --- > > diff --git a/fs/quota/quota.c b/fs/quota/quota.c > > index c7314f1..2b0c182 100644 > > --- a/fs/quota/quota.c > > +++ b/fs/quota/quota.c > > @@ -211,6 +211,7 @@ static int quota_getxstate(struct super_block *sb, void __user *addr) > > > > if (!sb->s_qcop->get_xstate) > > return -ENOSYS; > > + memset(&fqs, 0, sizeof(fqs)); > > ret = sb->s_qcop->get_xstate(sb, &fqs); > > if (!ret && copy_to_user(addr, &fqs, sizeof(fqs))) > > return -EFAULT; > -- > Jan Kara > SUSE Labs, CR -- Jan Kara SUSE Labs, CR -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/