Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932221Ab0KPT6p (ORCPT ); Tue, 16 Nov 2010 14:58:45 -0500 Received: from smtp.outflux.net ([198.145.64.163]:46767 "EHLO smtp.outflux.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758072Ab0KPT6o (ORCPT ); Tue, 16 Nov 2010 14:58:44 -0500 From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Pekka Enberg , Joe Perches , Linus Torvalds , Al Viro , Andrew Morton , Jiri Slaby , "David S. Miller" , Hugh Dickins , Manfred Spraul , Vasiliy Kulikov Subject: [PATCH] ipc: explicitly clear stack memory for shminfo Date: Tue, 16 Nov 2010 11:58:28 -0800 Message-Id: <1289937508-19458-1-git-send-email-kees.cook@canonical.com> X-Mailer: git-send-email 1.7.2.3 X-HELO: www.outflux.net Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 920 Lines: 30 This fixes a kernel stack memory contents leak by explicitly clearing the shminfo structure on the kernel stack before it is populated and copied back to userspace. Signed-off-by: Kees Cook Acked-by: Pekka Enberg --- ipc/shm.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/ipc/shm.c b/ipc/shm.c index 7d3bb22..1d3d41f 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -531,6 +531,7 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf { struct shminfo out; + memset(&out, 0, sizeof(out)); if(in->shmmax > INT_MAX) out.shmmax = INT_MAX; else -- 1.7.2.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/