Skip to content
Commit 0a0b9873 authored by Jann Horn's avatar Jann Horn Committed by Linus Torvalds
Browse files

compat: fix 4-byte infoleak via uninitialized struct field

Commit 3a4d44b6 ("ntp: Move adjtimex related compat syscalls to
native counterparts") removed the memset() in compat_get_timex().  Since
then, the compat adjtimex syscall can invoke do_adjtimex() with an
uninitialized ->tai.

If do_adjtimex() doesn't write to ->tai (e.g.  because the arguments are
invalid), compat_put_timex() then copies the uninitialized ->tai field
to userspace.

Fix it by adding the memset() back.

Fixes: 3a4d44b6

 ("ntp: Move adjtimex related compat syscalls to native counterparts")
Signed-off-by: default avatarJann Horn <jannh@google.com>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 94d7dbf1
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment