Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2020-01-15 Thread Arnd Bergmann
On Wed, Jan 15, 2020 at 2:09 PM Bartlomiej Zolnierkiewicz wrote: > > $ git grep -wl register_framebuffer | xargs grep -L framebuffer_alloc > > Documentation/fb/framebuffer.rst > > drivers/media/pci/ivtv/ivtvfb.c > > drivers/media/platform/vivid/vivid-osd.c > > drivers/video/fbdev/68328fb.c > > dr

Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2020-01-15 Thread Bartlomiej Zolnierkiewicz
On 1/13/20 1:49 PM, Arnd Bergmann wrote: > On Fri, Jan 3, 2020 at 2:09 PM Bartlomiej Zolnierkiewicz > wrote: >> On 10/29/19 8:02 PM, Eric W. Biederman wrote: >>> >>> The goal is to avoid memory that has values of the previous users of >>> that memory region from leaking to userspace. Which depe

Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2020-01-13 Thread Arnd Bergmann
On Fri, Jan 3, 2020 at 2:09 PM Bartlomiej Zolnierkiewicz wrote: > On 10/29/19 8:02 PM, Eric W. Biederman wrote: > > > > The goal is to avoid memory that has values of the previous users of > > that memory region from leaking to userspace. Which depending on who > > the previous user of that memor

Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2020-01-03 Thread Bartlomiej Zolnierkiewicz
On 10/29/19 8:02 PM, Eric W. Biederman wrote: > Dan Carpenter writes: > >> The "fix" struct has a 2 byte hole after ->ywrapstep and the >> "fix = info->fix;" assignment doesn't necessarily clear it. It depends >> on the compiler. >> >> Fixes: 1f5e31d7e55a ("fbmem: don't call copy_from/to_user(

Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2019-11-01 Thread Eric W. Biederman
Joe Perches writes: > On Wed, 2019-10-30 at 21:12 +0100, Andrea Righi wrote: >> Then memset() + memcpy() is probably the best option, >> since copying all those fields one by one looks quite ugly to me... > > A memset of an automatic before a memcpy to the same > automatic is unnecessary. You st

Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2019-10-31 Thread Joe Perches
On Wed, 2019-10-30 at 21:12 +0100, Andrea Righi wrote: > Then memset() + memcpy() is probably the best option, > since copying all those fields one by one looks quite ugly to me... A memset of an automatic before a memcpy to the same automatic is unnecessary.

Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2019-10-31 Thread Eric W. Biederman
Andrea Righi writes: > On Tue, Oct 29, 2019 at 02:02:11PM -0500, Eric W. Biederman wrote: >> Dan Carpenter writes: >> >> > The "fix" struct has a 2 byte hole after ->ywrapstep and the >> > "fix = info->fix;" assignment doesn't necessarily clear it. It depends >> > on the compiler. >> > >> > Fi

Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2019-10-31 Thread Andrea Righi
On Wed, Oct 30, 2019 at 02:26:21PM -0500, Eric W. Biederman wrote: > Andrea Righi writes: > > > On Tue, Oct 29, 2019 at 02:02:11PM -0500, Eric W. Biederman wrote: > >> Dan Carpenter writes: > >> > >> > The "fix" struct has a 2 byte hole after ->ywrapstep and the > >> > "fix = info->fix;" assign

Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2019-10-30 Thread Eric W. Biederman
Dan Carpenter writes: > The "fix" struct has a 2 byte hole after ->ywrapstep and the > "fix = info->fix;" assignment doesn't necessarily clear it. It depends > on the compiler. > > Fixes: 1f5e31d7e55a ("fbmem: don't call copy_from/to_user() with mutex held") > Signed-off-by: Dan Carpenter > ---

Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2019-10-30 Thread Andrea Righi
On Tue, Oct 29, 2019 at 02:02:11PM -0500, Eric W. Biederman wrote: > Dan Carpenter writes: > > > The "fix" struct has a 2 byte hole after ->ywrapstep and the > > "fix = info->fix;" assignment doesn't necessarily clear it. It depends > > on the compiler. > > > > Fixes: 1f5e31d7e55a ("fbmem: don't

Re: [PATCH] fbdev: potential information leak in do_fb_ioctl()

2019-10-29 Thread Joe Perches
On Tue, 2019-10-29 at 21:23 +0300, Dan Carpenter wrote: > The "fix" struct has a 2 byte hole after ->ywrapstep and the > "fix = info->fix;" assignment doesn't necessarily clear it. It depends > on the compiler. [] > diff --git a/drivers/video/fbdev/core/fbmem.c > b/drivers/video/fbdev/core/fbmem.

[PATCH] fbdev: potential information leak in do_fb_ioctl()

2019-10-29 Thread Dan Carpenter
The "fix" struct has a 2 byte hole after ->ywrapstep and the "fix = info->fix;" assignment doesn't necessarily clear it. It depends on the compiler. Fixes: 1f5e31d7e55a ("fbmem: don't call copy_from/to_user() with mutex held") Signed-off-by: Dan Carpenter --- I have 13 more similar places to pat