From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755566Ab0IYPwh (ORCPT ); Sat, 25 Sep 2010 11:52:37 -0400 Received: from cantor2.suse.de ([195.135.220.15]:51588 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751878Ab0IYPwg (ORCPT ); Sat, 25 Sep 2010 11:52:36 -0400 Date: Sat, 25 Sep 2010 17:52:35 +0200 Message-ID: From: Takashi Iwai To: Dan Rosenberg Cc: perex@perex.cz, alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, security@kernel.org, stable@kernel.org Subject: Re: [PATCH] sound/pci/rme9652: prevent reading uninitialized stack memory In-Reply-To: <1285427247.7957.35.camel@Dan> References: <1285427247.7957.35.camel@Dan> User-Agent: Wanderlust/2.15.6 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.7 Emacs/23.1 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org At Sat, 25 Sep 2010 11:07:27 -0400, Dan Rosenberg wrote: > > The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and > SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow > unprivileged users to read uninitialized kernel stack memory, because > several fields of the hdsp{m}_config_info structs declared on the stack > are not altered or zeroed before being copied back to the user. This > patch takes care of it. > > Signed-off-by: Dan Rosenberg Thanks, applied now with minor optimization (memset outside spinlock). Takashi > diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c linux-2.6.35.5/sound/pci/rme9652/hdsp.c > --- linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c 2010-09-20 16:59:09.000000000 -0400 > +++ linux-2.6.35.5/sound/pci/rme9652/hdsp.c 2010-09-25 10:59:42.000000000 -0400 > @@ -4601,6 +4601,8 @@ static int snd_hdsp_hwdep_ioctl(struct s > unsigned long flags; > int i; > > + memset(&info, 0, sizeof(info)); > + > err = hdsp_check_for_iobox(hdsp); > if (err < 0) > return err; > diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c linux-2.6.35.5/sound/pci/rme9652/hdspm.c > --- linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c 2010-09-20 16:59:09.000000000 -0400 > +++ linux-2.6.35.5/sound/pci/rme9652/hdspm.c 2010-09-25 10:58:44.000000000 -0400 > @@ -4128,6 +4128,9 @@ static int snd_hdspm_hwdep_ioctl(struct > case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO: > > spin_lock_irq(&hdspm->lock); > + > + memset(&info, 0, sizeof(info)); > + > info.pref_sync_ref = hdspm_pref_sync_ref(hdspm); > info.wordclock_sync_check = hdspm_wc_sync_check(hdspm); > > >