瀏覽代碼

staging: alarm-dev: information leak in alarm_ioctl()

Smatch complains that if we pass an invalid clock type then "ts" is
never set.  We need to check for errors earlier, otherwise we end up
passing uninitialized stack data to userspace.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Dan Carpenter 12 年之前
父節點
當前提交
e919b86c3b
共有 1 個文件被更改,包括 3 次插入1 次删除
  1. 3 1
      drivers/staging/android/alarm-dev.c

+ 3 - 1
drivers/staging/android/alarm-dev.c

@@ -264,6 +264,8 @@ static long alarm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	}
 	}
 
 
 	rv = alarm_do_ioctl(file, cmd, &ts);
 	rv = alarm_do_ioctl(file, cmd, &ts);
+	if (rv)
+		return rv;
 
 
 	switch (ANDROID_ALARM_BASE_CMD(cmd)) {
 	switch (ANDROID_ALARM_BASE_CMD(cmd)) {
 	case ANDROID_ALARM_GET_TIME(0):
 	case ANDROID_ALARM_GET_TIME(0):
@@ -272,7 +274,7 @@ static long alarm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		break;
 		break;
 	}
 	}
 
 
-	return rv;
+	return 0;
 }
 }
 #ifdef CONFIG_COMPAT
 #ifdef CONFIG_COMPAT
 static long alarm_compat_ioctl(struct file *file, unsigned int cmd,
 static long alarm_compat_ioctl(struct file *file, unsigned int cmd,