Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-23 20:51:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory

Browse Source 
The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
unprivileged users to read uninitialized kernel stack memory, because
several fields of the hdsp{m}_config_info structs declared on the stack
are not altered or zeroed before being copied back to the user.  This
patch takes care of it.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Dan Rosenberg 2010-09-25 11:07:27 -04:00 committed by Takashi Iwai
parent 0873a5ae74
commit e68d3b316a
2 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sound/pci/rme9652/hdsp.c
View File

@ -4609,6 +4609,7 @@ static int snd_hdsp_hwdep_ioctl(struct snd_hwdep *hw, struct file *file, unsigne
if (err < 0) if (err < 0)
return err; return err;
memset(&info, 0, sizeof(info));
spin_lock_irqsave(&hdsp->lock, flags); spin_lock_irqsave(&hdsp->lock, flags);
info.pref_sync_ref = (unsigned char)hdsp_pref_sync_ref(hdsp); info.pref_sync_ref = (unsigned char)hdsp_pref_sync_ref(hdsp);
info.wordclock_sync_check = (unsigned char)hdsp_wc_sync_check(hdsp); info.wordclock_sync_check = (unsigned char)hdsp_wc_sync_check(hdsp);

1
sound/pci/rme9652/hdspm.c
View File

@ -4127,6 +4127,7 @@ static int snd_hdspm_hwdep_ioctl(struct snd_hwdep * hw, struct file *file,
case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO: case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO:
memset(&info, 0, sizeof(info));
spin_lock_irq(&hdspm->lock); spin_lock_irq(&hdspm->lock);
info.pref_sync_ref = hdspm_pref_sync_ref(hdspm); info.pref_sync_ref = hdspm_pref_sync_ref(hdspm);
info.wordclock_sync_check = hdspm_wc_sync_check(hdspm); info.wordclock_sync_check = hdspm_wc_sync_check(hdspm);