lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[ARM] 3117/1: nwfpe kernel memory info leak

Browse Source 
Patch from Lennert Buytenhek

The routine that nwfpe uses for converting floats/doubles to
extended precision fails to zero two bytes of kernel stack.  This
is not immediately obvious, as the floatx80 structure has 16 bits
of implicit padding (by design.)  These two bytes are copied to
userspace when an stfe is emulated, causing a possible info leak.

Make the padding explicit and zero it out in the relevant places.

Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
This commit is contained in:
Lennert Buytenhek
2005-11-07 21:12:07 +00:00
committed by Russell King
parent 862184fe01
commit 06c03cac94
4 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
arch/arm/nwfpe/fpopcode.c
View File

@@ -29,14 +29,14 @@
#ifdef CONFIG_FPE_NWFPE_XP
const floatx80 floatx80Constant[] = {
{0x0000, 0x0000000000000000ULL}, /* extended 0.0 */
{0x3fff, 0x8000000000000000ULL}, /* extended 1.0 */
{0x4000, 0x8000000000000000ULL}, /* extended 2.0 */
{0x4000, 0xc000000000000000ULL}, /* extended 3.0 */
{0x4001, 0x8000000000000000ULL}, /* extended 4.0 */
{0x4001, 0xa000000000000000ULL}, /* extended 5.0 */
{0x3ffe, 0x8000000000000000ULL}, /* extended 0.5 */
{0x4002, 0xa000000000000000ULL} /* extended 10.0 */
{ .high = 0x0000, .low = 0x0000000000000000ULL},/* extended 0.0 */
{ .high = 0x3fff, .low = 0x8000000000000000ULL},/* extended 1.0 */
{ .high = 0x4000, .low = 0x8000000000000000ULL},/* extended 2.0 */
{ .high = 0x4000, .low = 0xc000000000000000ULL},/* extended 3.0 */
{ .high = 0x4001, .low = 0x8000000000000000ULL},/* extended 4.0 */
{ .high = 0x4001, .low = 0xa000000000000000ULL},/* extended 5.0 */
{ .high = 0x3ffe, .low = 0x8000000000000000ULL},/* extended 0.5 */
{ .high = 0x4002, .low = 0xa000000000000000ULL},/* extended 10.0 */
};
#endif