From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750974AbdE3GWr (ORCPT ); Tue, 30 May 2017 02:22:47 -0400 Received: from mailout3.samsung.com ([203.254.224.33]:17064 "EHLO mailout3.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750796AbdE3GWp (ORCPT ); Tue, 30 May 2017 02:22:45 -0400 X-AuditID: b6c32a58-f79896d000000567-7f-592d0fb37a92 From: Manjeet Pawar To: perex@perex.cz, tiwai@suse.de, alsa-devel@alsa-project.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org Cc: a.sahrawat@samsung.com, lalit.mohan@samsung.com, pankaj.m@samsung.com, Manjeet Pawar , Vaneet Narang Subject: [PATCH] ALSA: Adjust structure(snd_timer_tread) members to avoid 8 padding bytes Date: Tue, 30 May 2017 11:49:08 +0530 Message-Id: <1496125148-37895-1-git-send-email-manjeet.p@samsung.com> X-Mailer: git-send-email 1.9.1 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrLKsWRmVeSWpSXmKPExsWy7bCmpu5mft1Ig/3TOSwu7k61uHLxEJNF /2Izi83fO9gsLu+aw2Zxr3UtkHizlcmic1c/q8XLzW+YLA6dnMvowOWx4XMTm8e+t8vYPPq2 rGL02Hy62uPzJrkA1qhUm4zUxJTUIoXUvOT8lMy8dFsl7+B453hTMwNDXUNLC3MlhbzE3FRb JRefAF23zBygk5QUyhJzSoFCAYnFxUr6djZF+aUlqQoZ+cUltkrRhoZGeoYG5npGRkZ6Jqax VkamQCUJqRmf/k9iLPjNVXHpRloD4zrOLkZODgkBE4nfpz8wQthiEhfurWfrYuTiEBJYyiix b+MnVgjnE6PEsp9bmECqwJzP69Vhuk99e8UEUbSTUeLu4omMEM4XRomHEyYzg1SxCWhL7PnR xg5iiwhUSiz6f5AFpIhZYAajxN9fS8GWCwtESzSf+gjWwCKgKvH2YTtQnIODV8BVYtqcEIht chInj00GO0lCYAKbxKefPewQCReJ9+2boJ4Qlnh1fAtUXEri87u9bBANzYwSt18fh3J6GCV2 bm9jhaiyl3hw4yg7yDZmAU2J9bv0IcK2El/+dYANZRbgk+j9/YQJIq4ssez8ZiaQcgkBXomO NiGIsIfEydbZQPezA9mOEm15kMCKlVj9qYN1AqPcLITxCxgZVzGKpRYU56anFpsWmOgVJ+YW l+al6yXn525iBCc1rYgdjP9mBB1iFOBgVOLhPWGpEynEmlhWXJl7iFGCg1lJhDeARzdSiDcl sbIqtSg/vqg0J7X4EKMpMOwmMkuJJucDE25eSbyhiaWBiamZqYm5oYWpkjiv+sprEUIC6Ykl qdmpqQWpRTB9TBycUg2Mx4Wd32sv1zq5sejCvRKDE3JT1f9Xxb74kG+TlW9p/N36yJuXkaGJ PmvlE8LDZU/6qwntmnf0/jQ3y6LtZl6/6ksvaC29f/T0nz6B4q15PA/6OYNf7eKdueTLLe7/ 0s131U8zBixzcby/OOy1iYWgwEP3z12dzg2+H860Z73lOj77u/67OX+TlViKMxINtZiLihMB pIj55IADAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprFLMWRmVeSWpSXmKPExsWy7bCSnG4Lv26kwfcZzBYXd6daXLl4iMmi f7GZxebvHWwWl3fNYbO417oWSLzZymTRuauf1eLl5jdMFodOzmV04PLY8LmJzWPf22VsHn1b VjF6bD5d7fF5k1wAaxSXTUpqTmZZapG+XQJXxqf/kxgLfnNVXLqR1sC4jrOLkZNDQsBE4tS3 V0wQtpjEhXvr2UBsIYHtjBLTuhS7GDmA4qoSb5s1IEqEJVb+e84OUfKJUWLffycQm01AW2LP jzawuIhAvcS3SY9YQGxmgXmMEgcnJYOMERaIlLjz0gwkzAIy8WE7I0iYV8BVYtqcEIjpchIn j01mncDIu4CRYRWjaGpBcW56bnGBoV5xYm5xaV66XnJ+7iZGcIhpJe5gXDcj/BCjAAejEg/v BhWdSCHWxLLiytxDjBIczEoivAE8upFCvCmJlVWpRfnxRaU5qcWHGKU5WJTEeW9Vb4gQEkhP LEnNTk0tSC2CyTJxcEo1ME7sF3AVu1a8rsd1tvC3k52vTiT36U9N7zeY/lUvW+ypWK7WyoTH nPHxv25Jfd2pELto9iSuubnnZK+d1ZKbYhF96Xx4YcVy79vzRWbcnphQ2TRXY+mSZV/cq+Nd Xd7Pvp3WcXbF02UHpEOjlqy/w+qV415Rbxmj5nhz3YxA4WvauUnm+7zcBJRYijMSDbWYi4oT AXFQP8YtAgAA X-CMS-MailID: 20170530062242epcas5p1fb7f94e02c6550a60603ce28090cc70d X-Msg-Generator: CA X-Sender-IP: 182.195.40.14 X-Local-Sender: =?UTF-8?B?TWFuamVldCBQYXdhchtTUkktRGVsaGktUGxhdGZvcm0gUy9X?= =?UTF-8?B?IDEgVGVhbRvsgrzshLHsoITsnpAbRW5naW5lZXI=?= X-Global-Sender: =?UTF-8?B?TWFuamVldCBQYXdhchtTUkktRGVsaGktUGxhdGZvcm0gUy9X?= =?UTF-8?B?IDEgVGVhbRtTYW1zdW5nIEVsZWN0cm9uaWNzG0VuZ2luZWVy?= X-Sender-Code: =?UTF-8?B?QzEwG1NXQUhRG0MxMElEMDJJRDAyODExNQ==?= Content-Type: text/plain; charset="utf-8" X-MTR: 20170530062242epcas5p1fb7f94e02c6550a60603ce28090cc70d CMS-TYPE: 105P DLP-Filter: Pass X-CFilter-Loop: Reflected X-CMS-RootMailID: 20170530062242epcas5p1fb7f94e02c6550a60603ce28090cc70d X-RootMTR: 20170530062242epcas5p1fb7f94e02c6550a60603ce28090cc70d References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch is made to fix below CVE issue where 8 padding bytes are sent to user without being initialized. Structure members are adjusted to avoid 8 padding bytes. CVE-2016-4569/CVE-2016-4578: The stack object tread has a total size of 32 bytes. Its field event and val both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Fix patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cec8f96e49d9be372fdb0c3836dcf31ec71e457e https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git/commit/?h=for-next&id=9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6 These patches does memset on structure object to initialize 8 padding bytes, which can be skipped by adjusting structure members. Signed-off-by: Manjeet Pawar Signed-off-by: Vaneet Narang --- include/uapi/sound/asound.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/uapi/sound/asound.h b/include/uapi/sound/asound.h index a45be6b..820c5a0 100644 --- a/include/uapi/sound/asound.h +++ b/include/uapi/sound/asound.h @@ -789,8 +789,8 @@ enum { struct snd_timer_tread { int event; - struct timespec tstamp; unsigned int val; + struct timespec tstamp; }; /**************************************************************************** -- 1.9.1