From: Matteo Semenzato <mattew8...@gmail.com>
The comedi_cmd struct has an hole after chanlist_len that could contain
uninitialized
memory, this struct is copied to userspace.
Signed-off-by: Matteo Semenato <mattew8...@gmail.com>
---
drivers/staging/comedi/comedi_fops.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/staging/comedi/comedi_fops.c
b/drivers/staging/comedi/comedi_fops.c
index 727640e..1cdf0a2 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1718,6 +1718,8 @@ static int do_cmdtest_ioctl(struct comedi_device *dev,
unsigned int __user *user_chanlist;
int ret;
+ memset(&cmd, 0, sizeof(cmd));
+
/* get the user's cmd and do some simple validation */
ret = __comedi_get_user_cmd(dev, arg, &cmd);
if (ret)
--
2.3.2
_______________________________________________
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
