0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Kernel: Fix info leak from padding in GenericFramebufferDevice::ioctl

Browse source 
In FB_IOCTL_GET_PROPERTIES we were not initializing the padding of the
struct, leading to the potential of an kernel information leak if the
caller looked back at it's contents.

Lets just be extra paranoid and zero initialize all these structs
in we store on the stack while handling ioctls(..).
This commit is contained in:
Brian Gianforcaro 2021-12-29 02:03:43 -08:00 • committed by Brian Gianforcaro
parent e308536005
commit 98990dce53
Notes: sideshowbarker 2024-07-17 22:00:26 +09:00
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
Kernel/Graphics/GenericFramebufferDevice.cpp
View file

@ -37,7 +37,7 @@ ErrorOr<void> GenericFramebufferDevice::ioctl(OpenFileDescription&, unsigned req
switch (request) {
case FB_IOCTL_GET_PROPERTIES: {
auto user_properties = static_ptr_cast<FBProperties*>(arg);
FBProperties properties;
FBProperties properties {};
auto adapter = m_graphics_adapter.strong_ref();
if (!adapter)
return Error::from_errno(EIO);
@ -49,7 +49,7 @@ ErrorOr<void> GenericFramebufferDevice::ioctl(OpenFileDescription&, unsigned req
}
case FB_IOCTL_GET_HEAD_PROPERTIES: {
auto user_head_properties = static_ptr_cast<FBHeadProperties*>(arg);
FBHeadProperties head_properties;
FBHeadProperties head_properties {};
TRY(copy_from_user(&head_properties, user_head_properties));
TRY(verify_head_index(head_properties.head_index));
@ -86,7 +86,7 @@ ErrorOr<void> GenericFramebufferDevice::ioctl(OpenFileDescription&, unsigned req
}
case FB_IOCTL_GET_HEAD_VERTICAL_OFFSET_BUFFER: {
auto user_head_vertical_buffer_offset = static_ptr_cast<FBHeadVerticalOffset*>(arg);
FBHeadVerticalOffset head_vertical_buffer_offset;
FBHeadVerticalOffset head_vertical_buffer_offset {};
TRY(copy_from_user(&head_vertical_buffer_offset, user_head_vertical_buffer_offset));
TRY(verify_head_index(head_vertical_buffer_offset.head_index));