From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753228Ab0IPBCj (ORCPT ); Wed, 15 Sep 2010 21:02:39 -0400 Received: from proofpoint-cluster.metrocast.net ([65.175.128.136]:60592 "EHLO proofpoint-cluster.metrocast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752421Ab0IPBCi (ORCPT ); Wed, 15 Sep 2010 21:02:38 -0400 Date: Wed, 15 Sep 2010 20:59:19 -0400 Subject: Re: [PATCH] drivers/media/video/ivtv/ivtvfb.c: prevent reading uninitialized stack memory Message-ID: From: Andy Walls To: Dan Rosenberg Cc: ivtv-devel@ivtvdriver.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, security@kernel.org, stable@kernel.org Content-Type: text/plain; charset=utf-8 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.0.10011,1.0.148,0.0.0000 definitions=2010-09-15_19:2010-09-16,2010-09-15,1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx engine=5.0.0-1005130000 definitions=main-1009150135 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id o8G12oIh026774 Acked-by: Andy Walls By tomorrow evening I'll put this in my repo and ask for Mauro to pull it. Regards, Andy Dan Rosenberg wrote: >The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16 >bytes of uninitialized stack memory, because the "reserved" member of >the fb_vblank struct declared on the stack is not altered or zeroed >before being copied back to the user. This patch takes care of it. > >Signed-off-by: Dan Rosenberg > >--- linux-2.6.35.4.orig/drivers/media/video/ivtv/ivtvfb.c 2010-08-26 19:47:12.000000000 -0400 >+++ linux-2.6.35.4/drivers/media/video/ivtv/ivtvfb.c 2010-09-15 14:16:46.797375399 -0400 >@@ -458,6 +458,8 @@ static int ivtvfb_ioctl(struct fb_info * > struct fb_vblank vblank; > u32 trace; > >+ memset(&vblank, 0, sizeof(struct fb_vblank)); >+ > vblank.flags = FB_VBLANK_HAVE_COUNT |FB_VBLANK_HAVE_VCOUNT | > FB_VBLANK_HAVE_VSYNC; > trace = read_reg(IVTV_REG_DEC_LINE_FIELD) >> 16; > > > > {.n++%ݶw{.n+{G{ayʇڙ,jfhz_(階ݢj"mG?&~iOzv^m ?I