[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kernel-janitors
Subject:    Re: [patch] ALSA: compress: info leak in snd_compr_get_caps()
From:       Vinod Koul <vinod.koul () intel ! com>
Date:       2013-04-22 8:50:41
Message-ID: 20130422083841.GI6081 () intel ! com
[Download RAW message or body]

On Mon, Apr 22, 2013 at 10:42:25AM +0200, Takashi Iwai wrote:
> At Sun, 21 Apr 2013 14:07:29 +0300,
> Dan Carpenter wrote:
> > 
> > If the ->get_caps() function doesn't clear the buffer then there would
> > stack information leaked to userspace.  For example,
> > soc_compr_get_caps() can return success without clearing the buffer.
> 
> Thanks, applied now.
> 
> I found that we have also a similar problem in other ioctls
> (snd_compr_get_codec_caps() and snd_compr_get_params()), so applied
> the following patch in addition.
> 
> 
> Takashi
> 
> ---
> From: Takashi Iwai <tiwai@suse.de>
> Subject: [PATCH] ALSA: compress: Use kzalloc() for ioctls writing back data
> 
> Like the previous patch by Dan, we should clear the data to be
> returned from certain compress ioctls, namely,
> snd_compr_get_codec_caps() and snd_compr_get_params().
> This time, we can simply replace kmalloc() with kzalloc().
> 
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
If not too late..
Both Acked-by: Vinod Koul <vinod.koul@intel.com>

> ---
>  sound/core/compress_offload.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
> index 664c693..a0bc47f 100644
> --- a/sound/core/compress_offload.c
> +++ b/sound/core/compress_offload.c
> @@ -428,7 +428,7 @@ snd_compr_get_codec_caps(struct snd_compr_stream *stream, unsigned long arg)
>  	if (!stream->ops->get_codec_caps)
>  		return -ENXIO;
>  
> -	caps = kmalloc(sizeof(*caps), GFP_KERNEL);
> +	caps = kzalloc(sizeof(*caps), GFP_KERNEL);
>  	if (!caps)
>  		return -ENOMEM;
>  
> @@ -545,7 +545,7 @@ snd_compr_get_params(struct snd_compr_stream *stream, unsigned long arg)
>  	if (!stream->ops->get_params)
>  		return -EBADFD;
>  
> -	params = kmalloc(sizeof(*params), GFP_KERNEL);
> +	params = kzalloc(sizeof(*params), GFP_KERNEL);
>  	if (!params)
>  		return -ENOMEM;
>  	retval = stream->ops->get_params(stream, params);
> -- 
> 1.8.2.1
> 
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]