lkml.org 
[lkml]   [2010]   [Sep]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH] sound/pci/rme9652: prevent reading uninitialized stack memory
    From
    Date
    The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
    SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
    unprivileged users to read uninitialized kernel stack memory, because
    several fields of the hdsp{m}_config_info structs declared on the stack
    are not altered or zeroed before being copied back to the user. This
    patch takes care of it.

    Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>

    diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c linux-2.6.35.5/sound/pci/rme9652/hdsp.c
    --- linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c 2010-09-20 16:59:09.000000000 -0400
    +++ linux-2.6.35.5/sound/pci/rme9652/hdsp.c 2010-09-25 10:59:42.000000000 -0400
    @@ -4601,6 +4601,8 @@ static int snd_hdsp_hwdep_ioctl(struct s
    unsigned long flags;
    int i;

    + memset(&info, 0, sizeof(info));
    +
    err = hdsp_check_for_iobox(hdsp);
    if (err < 0)
    return err;
    diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c linux-2.6.35.5/sound/pci/rme9652/hdspm.c
    --- linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c 2010-09-20 16:59:09.000000000 -0400
    +++ linux-2.6.35.5/sound/pci/rme9652/hdspm.c 2010-09-25 10:58:44.000000000 -0400
    @@ -4128,6 +4128,9 @@ static int snd_hdspm_hwdep_ioctl(struct
    case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO:

    spin_lock_irq(&hdspm->lock);
    +
    + memset(&info, 0, sizeof(info));
    +
    info.pref_sync_ref = hdspm_pref_sync_ref(hdspm);
    info.wordclock_sync_check = hdspm_wc_sync_check(hdspm);




    \
     
     \ /
      Last update: 2010-09-27 20:09    [W:0.037 / U:29.800 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site