4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <geert+rene...@glider.be>

commit 8b27418f300cafbdbbb8cfa9c29d398ed34d6723 upstream.

If the "clock-frequency" DT property is not found, req_rate is used
uninitialized, and the "audio_clkout" clock will be created with an
arbitrary clock rate.

This uninitialized kernel stack data may leak to userspace through
/sys/kernel/debug/clk/clk_summary, cfr. the value in the "rate" column:

       clock     enable_cnt  prepare_cnt        rate   accuracy   phase
    --------------------------------------------------------------------
     audio_clkout         0            0  4001836240          0 0

Signed-off-by: Geert Uytterhoeven <geert+rene...@glider.be>
Acked-by: Kuninori Morimoto <kuninori.morimoto...@renesas.com>
Signed-off-by: Mark Brown <broo...@kernel.org>
Signed-off-by: Thong Ho <thong.ho...@rvc.renesas.com>
Signed-off-by: Nhan Nguyen <nhan.nguyen...@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 sound/soc/sh/rcar/adg.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/sh/rcar/adg.c
+++ b/sound/soc/sh/rcar/adg.c
@@ -437,7 +437,7 @@ static void rsnd_adg_get_clkout(struct r
        struct device *dev = rsnd_priv_to_dev(priv);
        struct device_node *np = dev->of_node;
        u32 ckr, rbgx, rbga, rbgb;
-       u32 rate, req_rate, div;
+       u32 rate, req_rate = 0, div;
        uint32_t count = 0;
        unsigned long req_48kHz_rate, req_441kHz_rate;
        int i;


Reply via email to