MIME-Version: 1.0
In-Reply-To: <1297347904.13370.9.camel@dan>
References: <1297347904.13370.9.camel@dan>
Date: Mon, 14 Feb 2011 16:41:46 +0800
Message-ID: <AANLkTi=BxmspGnK1FLwNswQP34kTU96Q0G2xBNoxypCh@mail.gmail.com>
Subject: Re: [Security] [PATCH] xfs: prevent leaking uninitialized stack
 memory in FSGEOMETRY_V1
From: Eugene Teo <eugeneteo@kernel.org>
To: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: aelder@sgi.com, xfs-masters@oss.sgi.com, xfs@oss.sgi.com,
        security@kernel.org, linux-kernel@vger.kernel.org, stable@kernel.org,
        Eugene Teo <eugeneteo@kernel.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8BIT
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1082
Lines: 23

On Thu, Feb 10, 2011 at 10:25 PM, Dan Rosenberg
<drosenberg@vsecurity.com> wrote:
> The FSGEOMETRY_V1 ioctl (and its compat equivalent) calls out to
> xfs_fs_geometry() with a version number of 3. ?This code path does not
> fill in the logsunit member of the passed xfs_fsop_geom_t, leading to
> the leaking of four bytes of uninitialized stack data to potentially
> unprivileged callers. ?Since all other members are filled in all code
> paths and there are no padding bytes in this structure, it's safe to
> avoid an expensive memset() in favor of just clearing this one field.
>
> Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>

There are three callers to xfs_fs_geometry() with version number 3 and
4. I don't see any for version number 2, so this looks fine.

Reviewed-by: Eugene Teo <eugeneteo@kernel.org>

Thanks, Eugene
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/