lkml.org 
[lkml]   [2010]   [Sep]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH] sound/pci/rme9652: prevent reading uninitialized stack memory
From
Date
The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
unprivileged users to read uninitialized kernel stack memory, because
several fields of the hdsp{m}_config_info structs declared on the stack
are not altered or zeroed before being copied back to the user. This
patch takes care of it.
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>

diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c linux-2.6.35.5/sound/pci/rme9652/hdsp.c
--- linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c 2010-09-20 16:59:09.000000000 -0400
+++ linux-2.6.35.5/sound/pci/rme9652/hdsp.c 2010-09-25 10:59:42.000000000 -0400
@@ -4601,6 +4601,8 @@ static int snd_hdsp_hwdep_ioctl(struct s
unsigned long flags;
int i;

+ memset(&info, 0, sizeof(info));
+
err = hdsp_check_for_iobox(hdsp);
if (err < 0)
return err;
diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c linux-2.6.35.5/sound/pci/rme9652/hdspm.c
--- linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c 2010-09-20 16:59:09.000000000 -0400
+++ linux-2.6.35.5/sound/pci/rme9652/hdspm.c 2010-09-25 10:58:44.000000000 -0400
@@ -4128,6 +4128,9 @@ static int snd_hdspm_hwdep_ioctl(struct
case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO:

spin_lock_irq(&hdspm->lock);
+
+ memset(&info, 0, sizeof(info));
+
info.pref_sync_ref = hdspm_pref_sync_ref(hdspm);
info.wordclock_sync_check = hdspm_wc_sync_check(hdspm);




\
 
 \ /
  Last update: 2010-09-27 20:09    [from the cache]
©2003-2011 Jasper Spaans