Eric Biggers a754de70f6 tty: fix compat TIOCGSERIAL leaking uninitialized memory ...

commit 17329563a9 upstream.

Commit 7765435030 ("take compat TIOC[SG]SERIAL treatment into
tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start
copying a whole 'serial_struct32' to userspace rather than individual
fields, but failed to initialize all padding and fields -- namely the
hole after the 'iomem_reg_shift' field, and the 'reserved' field.

Fix this by initializing the struct to zero.

[v2: use sizeof, and convert the adjacent line for consistency.]

Reported-by: syzbot+8da9175e28eadcb203ce@syzkaller.appspotmail.com
Fixes: 7765435030 ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()")
Cc: <stable@vger.kernel.org> # v4.20+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20200224182044.234553-2-ebiggers@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2020-03-25 08:25:52 +01:00

..

hvc

tty: hvcs: Fix odd use of strlcpy

2019-09-04 12:43:44 +02:00

ipwireless

tty: add SPDX identifiers to Kconfig and Makefiles

2019-04-04 18:48:43 +02:00

serdev

serdev: ttyport: restore client ops on deregistration

2020-02-28 17:22:19 +01:00

serial

serial: 8250_exar: add support for ACCES cards

2020-03-12 13:00:20 +01:00

vt

vt: selection, push sel_lock up

2020-03-12 13:00:21 +01:00

amiserial.c

…

cyclades.c

…

ehv_bytechan.c

…

goldfish.c

…

isicom.c

tty/isicom: remove redundant assignment to variable word_count

2019-09-04 12:43:44 +02:00

Kconfig

docs: serial: move it to the driver-api

2019-07-15 11:03:03 -03:00

Makefile

tty: Add NULL TTY driver

2019-04-16 15:21:34 +02:00

mips_ejtag_fdc.c

…

moxa.c

…

moxa.h

…

mxser.c

…

mxser.h

…

n_gsm.c

tty: n_gsm: avoid recursive locking with async port hangup

2019-09-04 12:43:56 +02:00

n_hdlc.c

tty: n_hdlc: fix build on SPARC

2019-10-04 15:14:20 +02:00

n_null.c

…

n_r3964.c

…

n_tracerouter.c

…

n_tracesink.c

…

n_tracesink.h

…

n_tty.c

n_tty: check for negative and zero space return from tty_write_room

2019-04-16 15:21:33 +02:00

nozomi.c

tty: nozomi: Use dev_get_drvdata

2019-09-04 12:43:44 +02:00

pty.c

…

rocket_int.h

…

rocket.c

Merge tag 'tty-5.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2019-05-08 10:07:28 -07:00

rocket.h

tty: rocket: Remove RCPK_GET_STRUCT ioctl

2019-04-25 11:58:56 +02:00

synclink_gt.c

tty: synclink_gt: Adjust indentation in several functions

2020-02-24 08:36:47 +01:00

synclink.c

…

synclinkmp.c

tty: synclinkmp: Adjust indentation in several functions

2020-02-24 08:36:47 +01:00

sysrq.c

panic: avoid the extra noise dmesg

2019-05-14 19:52:51 -07:00

tty_audit.c

…

tty_baudrate.c

…

tty_buffer.c

…

tty_io.c

tty: fix compat TIOCGSERIAL leaking uninitialized memory

2020-03-25 08:25:52 +01:00

tty_ioctl.c

…

tty_jobctrl.c

…

tty_ldisc.c

proc/sysctl: add shared variables for range check

2019-07-18 17:08:07 -07:00

tty_ldsem.c

tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop

2019-07-25 15:39:24 +02:00

tty_mutex.c

…

tty_port.c

serdev: ttyport: restore client ops on deregistration

2020-02-28 17:22:19 +01:00

ttynull.c

tty: Add NULL TTY driver

2019-04-16 15:21:34 +02:00

vcc.c

tty: fix up a few remaining files without SPDX identifiers

2019-04-04 18:48:43 +02:00