diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-01-07 10:34:07 +0300 |
|---|---|---|
| committer | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2022-01-10 16:36:45 +0100 |
| commit | 7bf2e4d5ca1c94a9b0f730498b3d01768a72dcbd (patch) | |
| tree | 5198dc8988854deb98617409324d1b4af9436622 /drivers/acpi | |
| parent | 31834aaa4e2a26d8d1f6b36703bb35cfdb8fc98c (diff) | |
ACPI: pfr_telemetry: Fix info leak in pfrt_log_ioctl()
The "data_info" struct is copied to the user. It has a 4 byte struct
hole after the last struct member so we need to memset that to avoid
copying uninitialized stack data to the user.
Fixes: b0013e037a8b ("ACPI: Introduce Platform Firmware Runtime Telemetry driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Diffstat (limited to 'drivers/acpi')
| -rw-r--r-- | drivers/acpi/pfr_telemetry.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/acpi/pfr_telemetry.c b/drivers/acpi/pfr_telemetry.c index da50dd80192c..9abf350bd7a5 100644 --- a/drivers/acpi/pfr_telemetry.c +++ b/drivers/acpi/pfr_telemetry.c @@ -83,6 +83,7 @@ static int get_pfrt_log_data_info(struct pfrt_log_data_info *data_info, union acpi_object *out_obj, in_obj, in_buf; int ret = -EBUSY; + memset(data_info, 0, sizeof(*data_info)); memset(&in_obj, 0, sizeof(in_obj)); memset(&in_buf, 0, sizeof(in_buf)); in_obj.type = ACPI_TYPE_PACKAGE; |