| /* "The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel |
| before 3.12.8 does not initialize a certain structure member, which allows |
| local users to obtain sensitive information from kernel memory by |
| leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call." |
| |
| Fixed e.g. by e7834c71c2cacc621ddc64bd71f83ef2054f6539 on linux-3.12.y |
| in linux-stable. */ |
| |
| #include <string.h> |
| |
| #include "test-uaccess.h" |
| |
| /* Adapted from include/linux/yam.h */ |
| |
| struct yamcfg { |
| unsigned int mask; /* Mask of commands */ |
| unsigned int iobase; /* IO Base of COM port */ |
| unsigned int irq; /* IRQ of COM port */ |
| unsigned int bitrate; /* Bit rate of radio port */ |
| unsigned int baudrate; /* Baud rate of the RS232 port */ |
| unsigned int txdelay; /* TxDelay */ |
| unsigned int txtail; /* TxTail */ |
| unsigned int persist; /* Persistence */ |
| unsigned int slottime; /* Slottime */ |
| unsigned int mode; /* mode 0 (simp), 1(Dupl), 2(Dupl+delay) */ |
| unsigned int holddly; /* PTT delay in FullDuplex 2 mode */ |
| }; |
| |
| struct yamdrv_ioctl_cfg { |
| int cmd; /* { dg-message "field 'cmd' is uninitialized \\(4 bytes\\)" } */ |
| struct yamcfg cfg; |
| }; |
| |
| /* Adapted from include/asm-generic/errno-base.h */ |
| |
| #define EFAULT 14 /* Bad address */ |
| |
| /* Adapted from drivers/net/hamradio/yam.c */ |
| |
| struct yam_port { |
| /* [...snip...] */ |
| |
| int bitrate; |
| int baudrate; |
| int iobase; |
| int irq; |
| int dupmode; |
| |
| /* [...snip...] */ |
| |
| int txd; /* tx delay */ |
| int holdd; /* duplex ptt delay */ |
| int txtail; /* txtail delay */ |
| int slot; /* slottime */ |
| int pers; /* persistence */ |
| |
| /* [...snip...] */ |
| }; |
| |
| /* Broken version, leaving yi.cmd uninitialized. */ |
| |
| static int yam_ioctl(/* [...snip...] */ |
| void __user *dst, struct yam_port *yp) |
| { |
| struct yamdrv_ioctl_cfg yi; /* { dg-message "region created on stack here" "memspace event" } */ |
| /* { dg-message "capacity: 48 bytes" "capacity event" { target *-*-* } .-1 } */ |
| |
| /* [...snip...] */ |
| |
| /* case SIOCYAMGCFG: */ |
| yi.cfg.mask = 0xffffffff; |
| yi.cfg.iobase = yp->iobase; |
| yi.cfg.irq = yp->irq; |
| yi.cfg.bitrate = yp->bitrate; |
| yi.cfg.baudrate = yp->baudrate; |
| yi.cfg.mode = yp->dupmode; |
| yi.cfg.txdelay = yp->txd; |
| yi.cfg.holddly = yp->holdd; |
| yi.cfg.txtail = yp->txtail; |
| yi.cfg.persist = yp->pers; |
| yi.cfg.slottime = yp->slot; |
| if (copy_to_user(dst, &yi, sizeof(struct yamdrv_ioctl_cfg))) /* { dg-warning "potential exposure of sensitive information by copying uninitialized data from stack" "warning" } */ |
| /* { dg-message "4 bytes are uninitialized" "how much note" { target *-*-* } .-1 } */ |
| return -EFAULT; |
| /* [...snip...] */ |
| |
| return 0; |
| } |
| |
| /* Fixed version, with a memset. */ |
| |
| static int yam_ioctl_fixed(/* [...snip...] */ |
| void __user *dst, struct yam_port *yp) |
| { |
| struct yamdrv_ioctl_cfg yi; |
| |
| /* [...snip...] */ |
| |
| /* case SIOCYAMGCFG: */ |
| memset(&yi, 0, sizeof(yi)); |
| yi.cfg.mask = 0xffffffff; |
| yi.cfg.iobase = yp->iobase; |
| yi.cfg.irq = yp->irq; |
| yi.cfg.bitrate = yp->bitrate; |
| yi.cfg.baudrate = yp->baudrate; |
| yi.cfg.mode = yp->dupmode; |
| yi.cfg.txdelay = yp->txd; |
| yi.cfg.holddly = yp->holdd; |
| yi.cfg.txtail = yp->txtail; |
| yi.cfg.persist = yp->pers; |
| yi.cfg.slottime = yp->slot; |
| if (copy_to_user(dst, &yi, sizeof(struct yamdrv_ioctl_cfg))) /* { dg-bogus "" } */ |
| return -EFAULT; |
| /* [...snip...] */ |
| |
| return 0; |
| } |
