lkml.org 
[lkml]   [2020]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 33/48] cec-api: prevent leaking memory through hole in structure
    Date
    From: Hans Verkuil <hverkuil-cisco@xs4all.nl>

    [ Upstream commit 6c42227c3467549ddc65efe99c869021d2f4a570 ]

    Fix this smatch warning:

    drivers/media/cec/core/cec-api.c:156 cec_adap_g_log_addrs() warn: check that 'log_addrs' doesn't leak information (struct has a hole after
    'features')

    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/cec/cec-api.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
    index 12d6764844724..ed75636a6fb34 100644
    --- a/drivers/media/cec/cec-api.c
    +++ b/drivers/media/cec/cec-api.c
    @@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap,
    struct cec_log_addrs log_addrs;

    mutex_lock(&adap->lock);
    - log_addrs = adap->log_addrs;
    + /*
    + * We use memcpy here instead of assignment since there is a
    + * hole at the end of struct cec_log_addrs that an assignment
    + * might ignore. So when we do copy_to_user() we could leak
    + * one byte of memory.
    + */
    + memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs));
    if (!adap->is_configured)
    memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID,
    sizeof(log_addrs.log_addr));
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-08-21 18:23    [W:4.148 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site