lkml.org 
[lkml]   [2010]   [Oct]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[03/17] ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory
    2.6.27-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Dan Rosenberg <drosenberg@vsecurity.com>

    commit e68d3b316ab7b02a074edc4f770e6a746390cb7d upstream.

    The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
    SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
    unprivileged users to read uninitialized kernel stack memory, because
    several fields of the hdsp{m}_config_info structs declared on the stack
    are not altered or zeroed before being copied back to the user. This
    patch takes care of it.

    Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    sound/pci/rme9652/hdsp.c | 1 +
    sound/pci/rme9652/hdspm.c | 1 +
    2 files changed, 2 insertions(+)

    --- a/sound/pci/rme9652/hdsp.c
    +++ b/sound/pci/rme9652/hdsp.c
    @@ -4569,6 +4569,7 @@ static int snd_hdsp_hwdep_ioctl(struct s
    snd_printk(KERN_ERR "Hammerfall-DSP: Firmware needs to be uploaded to the card.\n");
    return -EINVAL;
    }
    + memset(&info, 0, sizeof(info));
    spin_lock_irqsave(&hdsp->lock, flags);
    info.pref_sync_ref = (unsigned char)hdsp_pref_sync_ref(hdsp);
    info.wordclock_sync_check = (unsigned char)hdsp_wc_sync_check(hdsp);
    --- a/sound/pci/rme9652/hdspm.c
    +++ b/sound/pci/rme9652/hdspm.c
    @@ -4133,6 +4133,7 @@ static int snd_hdspm_hwdep_ioctl(struct

    case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO:

    + memset(&info, 0, sizeof(info));
    spin_lock_irq(&hdspm->lock);
    info.pref_sync_ref = hdspm_pref_sync_ref(hdspm);
    info.wordclock_sync_check = hdspm_wc_sync_check(hdspm);



    \
     
     \ /
      Last update: 2010-10-22 20:45    [W:2.286 / U:0.472 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site