Re: [patch] [media] media: info leak in __media_device_enum_links()

[Laurent Pinchart]

Hi Dan,

On Friday 31 May 2013 15:24:45 Dan Carpenter wrote:
 Ping?

Oops, sorry for having missed the patch.

 On Sat, Apr 13, 2013 at 12:32:15PM +0300, Dan Carpenter wrote:
  These structs have holes and reserved struct members which aren't
  cleared.  I've added a memset() so we don't leak stack information.
  
  Signed-off-by: Dan Carpenter dan.carpen...@oracle.com

Acked-by: Laurent Pinchart laurent.pinch...@ideasonboard.com

I've taken the patch in my tree, Added a CC: sta...@vger.kernel.org and 
issued a pull request.

  diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
  index 99b80b6..450c0d1 100644
  --- a/drivers/media/media-device.c
  +++ b/drivers/media/media-device.c
  @@ -139,6 +139,8 @@ static long __media_device_enum_links(struct
  media_device *mdev, 
  for (p = 0; p  entity-num_pads; p++) {
  
  struct media_pad_desc pad;
  
  +
  +   memset(pad, 0, sizeof(pad));
  
  media_device_kpad_to_upad(entity-pads[p], pad);
  if (copy_to_user(links-pads[p], pad, sizeof(pad)))
  
  return -EFAULT;
  
  @@ -156,6 +158,7 @@ static long __media_device_enum_links(struct
  media_device *mdev, 
  if (entity-links[l].source-entity != entity)
  
  continue;
  
  +   memset(link, 0, sizeof(link));
  
  media_device_kpad_to_upad(entity-links[l].source,
  
link.source);
  
  media_device_kpad_to_upad(entity-links[l].sink,

-- 
Regards,

Laurent Pinchart

--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [patch] [media] media: info leak in __media_device_enum_links()

[Dan Carpenter]

Ping?

regards,
dan carpenter

On Sat, Apr 13, 2013 at 12:32:15PM +0300, Dan Carpenter wrote:
 These structs have holes and reserved struct members which aren't
 cleared.  I've added a memset() so we don't leak stack information.
 
 Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
 
 diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
 index 99b80b6..450c0d1 100644
 --- a/drivers/media/media-device.c
 +++ b/drivers/media/media-device.c
 @@ -139,6 +139,8 @@ static long __media_device_enum_links(struct media_device 
 *mdev,
  
   for (p = 0; p  entity-num_pads; p++) {
   struct media_pad_desc pad;
 +
 + memset(pad, 0, sizeof(pad));
   media_device_kpad_to_upad(entity-pads[p], pad);
   if (copy_to_user(links-pads[p], pad, sizeof(pad)))
   return -EFAULT;
 @@ -156,6 +158,7 @@ static long __media_device_enum_links(struct media_device 
 *mdev,
   if (entity-links[l].source-entity != entity)
   continue;
  
 + memset(link, 0, sizeof(link));
   media_device_kpad_to_upad(entity-links[l].source,
 link.source);
   media_device_kpad_to_upad(entity-links[l].sink,
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[patch] [media] media: info leak in __media_device_enum_links()

[Dan Carpenter]

These structs have holes and reserved struct members which aren't
cleared.  I've added a memset() so we don't leak stack information.

Signed-off-by: Dan Carpenter dan.carpen...@oracle.com

diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index 99b80b6..450c0d1 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -139,6 +139,8 @@ static long __media_device_enum_links(struct media_device 
*mdev,
 
for (p = 0; p  entity-num_pads; p++) {
struct media_pad_desc pad;
+
+   memset(pad, 0, sizeof(pad));
media_device_kpad_to_upad(entity-pads[p], pad);
if (copy_to_user(links-pads[p], pad, sizeof(pad)))
return -EFAULT;
@@ -156,6 +158,7 @@ static long __media_device_enum_links(struct media_device 
*mdev,
if (entity-links[l].source-entity != entity)
continue;
 
+   memset(link, 0, sizeof(link));
media_device_kpad_to_upad(entity-links[l].source,
  link.source);
media_device_kpad_to_upad(entity-links[l].sink,
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html