Browse Source

i2c: fix kernel memory disclosure in dev interface

i2c_smbus_xfer() does not always fill an entire block, allowing
kernel stack memory disclosure through the temp variable. Clear
it before it's read to.

Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Cc: stable@kernel.org
Vlad Tsyrklevich 8 years ago
parent
commit
30f939feae
1 changed files with 1 additions and 1 deletions
  1. 1 1
      drivers/i2c/i2c-dev.c

+ 1 - 1
drivers/i2c/i2c-dev.c

@@ -331,7 +331,7 @@ static noinline int i2cdev_ioctl_smbus(struct i2c_client *client,
 		unsigned long arg)
 {
 	struct i2c_smbus_ioctl_data data_arg;
-	union i2c_smbus_data temp;
+	union i2c_smbus_data temp = {};
 	int datasize, res;
 
 	if (copy_from_user(&data_arg,