hinfo_to_cinfo() does no operation on `cinfo` when `hinfo` is NULL, causing kioc_to_mimd() to copy uninitialized stack memory to userspace. Fix it by initializing `cinfo` with memset().
Cc: [email protected] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Dan Carpenter <[email protected]> Suggested-by: Arnd Bergmann <[email protected]> Signed-off-by: Peilin Ye <[email protected]> --- drivers/scsi/megaraid/megaraid_mm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c index 8df53446641a..9df0e6b253a8 100644 --- a/drivers/scsi/megaraid/megaraid_mm.c +++ b/drivers/scsi/megaraid/megaraid_mm.c @@ -816,6 +816,8 @@ kioc_to_mimd(uioc_t *kioc, mimd_t __user *mimd) case MEGAIOC_QADAPINFO: + memset(&cinfo, 0, sizeof(cinfo)); + hinfo = (mraid_hba_info_t *)(unsigned long) kioc->buf_vaddr; -- 2.25.1
