[Linux-kernel-mentees] [PATCH v2] firewire: Prevent kernel-infoleak in ioctl_get_info()

From: Peilin Ye
Date: Mon Jul 27 2020 - 11:46:45 EST

ioctl_get_info() is copying uninitialized stack memory to userspace due to
the compiler not initializing holes in statically allocated structures.
Fix it by initializing `event` using memset() in fill_bus_reset_event().

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 344bbc4de14e ("firewire: Generalize get_config_rom to get_info.")
Suggested-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Suggested-by: Arnd Bergmann <arnd@xxxxxxxx>
Acked-by: Arnd Bergmann <arnd@xxxxxxxx>
Signed-off-by: Peilin Ye <yepeilin.cs@xxxxxxxxx>
Change in v2:
- Add an appropriate `Fixes` tag. (Suggested by Arnd Bergmann

drivers/firewire/core-cdev.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index fb6c651214f3..2341d762df5b 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -340,6 +340,8 @@ static void fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
struct fw_card *card = client->device->card;

+ memset(event, 0, sizeof(*event));

event->closure = client->bus_reset_closure;