Merge tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

f720d7df · Linus Torvalds <[email protected]> · 2014-11-14 12:44:48 -08:00

Pull firewire fix from Stefan Richter:
 "IEEE 1394 (FireWire) subsystem fix: The character device file
  interface for raw 1394 I/O took uninitialized kernel stack as
  substitute for missing ioctl() argument data.  This could partially
  show up in subsequent read() output"

* tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: cdev: prevent kernel stack leaking into ioctl arguments

Commit: f720d7df993b2cd62c723f1803bc8330871d478f
Parents: 3865efcb · eaca2d8e

Merge commit. Changes below are compared with the first parent: 3865efcb.

Changes

1 files changed · +1 −2

File	Status	Add	Del	Content
drivers/firewire/core-cdev.c	modified	+1	−2	View file

drivers/firewire/core-cdev.c

View file

diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 5d997a3..2a3973a 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -1637,8 +1637,7 @@ static int dispatch_ioctl(struct client *client,
 	    _IOC_SIZE(cmd) > sizeof(buffer))
 		return -ENOTTY;
 
-	if (_IOC_DIR(cmd) == _IOC_READ)
-		memset(&buffer, 0, _IOC_SIZE(cmd));
+	memset(&buffer, 0, sizeof(buffer));
 
 	if (_IOC_DIR(cmd) & _IOC_WRITE)
 		if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))