compat: fix 4-byte infoleak via uninitialized struct field
authorJann Horn <jannh@google.com>
Fri, 11 May 2018 00:19:01 +0000 (02:19 +0200)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 11 May 2018 00:51:58 +0000 (17:51 -0700)
commit0a0b98734479aa5b3c671d5190e86273372cab95
treed5b5f0604c0cd3ea41bdcf5c1eda8793bc720129
parent94d7dbf108813ea45a91e27e9a8bd231d5a23fa7
compat: fix 4-byte infoleak via uninitialized struct field

Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to
native counterparts") removed the memset() in compat_get_timex().  Since
then, the compat adjtimex syscall can invoke do_adjtimex() with an
uninitialized ->tai.

If do_adjtimex() doesn't write to ->tai (e.g.  because the arguments are
invalid), compat_put_timex() then copies the uninitialized ->tai field
to userspace.

Fix it by adding the memset() back.

Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
kernel/compat.c