i2c: fix kernel memory disclosure in dev interface

vlad902 · Wolfram Sang · commit 30f939feaeee · 2017-01-12T20:06:10.000+01:00
i2c_smbus_xfer() does not always fill an entire block, allowing
kernel stack memory disclosure through the temp variable. Clear
it before it's read to.

Signed-off-by: Vlad Tsyrklevich &lt;vlad@tsyrklevich.net&gt;
Signed-off-by: Wolfram Sang &lt;wsa@the-dreams.de&gt;
Cc: stable@kernel.org
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
@@ -331,7 +331,7 @@ static noinline int i2cdev_ioctl_smbus(struct i2c_client *client,
 		unsigned long arg)
 {
 	struct i2c_smbus_ioctl_data data_arg;
-	union i2c_smbus_data temp;
+	union i2c_smbus_data temp = {};
 	int datasize, res;
 
 	if (copy_from_user(&data_arg,

Original file line number	Diff line number	Diff line change
`@@ -331,7 +331,7 @@ static noinline int i2cdev_ioctl_smbus(struct i2c_client *client,`
`331`	`331`	`unsigned long arg)`
`332`	`332`	`{`
`333`	`333`	`struct i2c_smbus_ioctl_data data_arg;`
`334`		`- union i2c_smbus_data temp;`
	`334`	`+ union i2c_smbus_data temp = {};`
`335`	`335`	`int datasize, res;`
`336`	`336`
`337`	`337`	`if (copy_from_user(&data_arg,`