Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1681076 > unrolled thread

[PATCH][-next] mqueue: fix incorrect memset size for object v

Back to article view | Back to linux.kernel

Contents

  [PATCH][-next] mqueue: fix incorrect memset size for object v Colin King <colin.king@canonical.com> - 2017-07-04 18:10 +0200
    Re: [PATCH][-next] mqueue: fix incorrect memset size for object v Al Viro <viro@ZenIV.linux.org.uk> - 2017-07-04 19:20 +0200

#1681076 — [PATCH][-next] mqueue: fix incorrect memset size for object v

From: Colin Ian King <colin.king@canonical.com>

The size of the memset is incorrect, it is currently using the size
of attr (a struct mq_attr *) and not of v (a struct compat_mq_attr)

Detected by CoverityScan, CID#1449362 ("Wrong sizeof argument")

Fixes: 045256d59da6 ("mqueue: move compat syscalls to native ones")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 ipc/mqueue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index a1a326569268..c9ff943f19ab 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -1449,7 +1449,7 @@ static inline int put_compat_mq_attr(const struct mq_attr *attr,
 {
 	struct compat_mq_attr v;
 
-	memset(&v, 0, sizeof(attr));
+	memset(&v, 0, sizeof(v));
 	v.mq_flags = attr->mq_flags;
 	v.mq_maxmsg = attr->mq_maxmsg;
 	v.mq_msgsize = attr->mq_msgsize;
-- 
2.11.0

[toc] | [next] | [standalone]

#1681098

On Tue, Jul 04, 2017 at 05:09:19PM +0100, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
> 
> The size of the memset is incorrect, it is currently using the size
> of attr (a struct mq_attr *) and not of v (a struct compat_mq_attr)

Folded (and that was a moderate infoleak - ->__reserved[] thing had
been copied out uninitialized).

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web