Re: [patch] [media] media: info leak in __media_device_enum_links()

[Laurent Pinchart]

Hi Dan,

On Friday 31 May 2013 15:24:45 Dan Carpenter wrote:
> Ping?

Oops, sorry for having missed the patch.

> On Sat, Apr 13, 2013 at 12:32:15PM +0300, Dan Carpenter wrote:
> > These structs have holes and reserved struct members which aren't
> > cleared.  I've added a memset() so we don't leak stack information.
> > 
> > Signed-off-by: Dan Carpenter 

Acked-by: Laurent Pinchart 

I've taken the patch in my tree, Added a "CC: sta...@vger.kernel.org" and 
issued a pull request.

> > diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
> > index 99b80b6..450c0d1 100644
> > --- a/drivers/media/media-device.c
> > +++ b/drivers/media/media-device.c
> > @@ -139,6 +139,8 @@ static long __media_device_enum_links(struct
> > media_device *mdev,> 
> > for (p = 0; p < entity->num_pads; p++) {
> > 
> > struct media_pad_desc pad;
> > 
> > +
> > +   memset(&pad, 0, sizeof(pad));
> > 
> > media_device_kpad_to_upad(&entity->pads[p], &pad);
> > if (copy_to_user(&links->pads[p], &pad, sizeof(pad)))
> > 
> > return -EFAULT;
> > 
> > @@ -156,6 +158,7 @@ static long __media_device_enum_links(struct
> > media_device *mdev,> 
> > if (entity->links[l].source->entity != entity)
> > 
> > continue;
> > 
> > +   memset(&link, 0, sizeof(link));
> > 
> > media_device_kpad_to_upad(entity->links[l].source,
> > 
> >   &link.source);
> > 
> > media_device_kpad_to_upad(entity->links[l].sink,

-- 
Regards,

Laurent Pinchart

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [patch] [media] media: info leak in __media_device_enum_links()

[Dan Carpenter]

Ping?

regards,
dan carpenter

On Sat, Apr 13, 2013 at 12:32:15PM +0300, Dan Carpenter wrote:
> These structs have holes and reserved struct members which aren't
> cleared.  I've added a memset() so we don't leak stack information.
> 
> Signed-off-by: Dan Carpenter 
> 
> diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
> index 99b80b6..450c0d1 100644
> --- a/drivers/media/media-device.c
> +++ b/drivers/media/media-device.c
> @@ -139,6 +139,8 @@ static long __media_device_enum_links(struct media_device 
> *mdev,
>  
>   for (p = 0; p < entity->num_pads; p++) {
>   struct media_pad_desc pad;
> +
> + memset(&pad, 0, sizeof(pad));
>   media_device_kpad_to_upad(&entity->pads[p], &pad);
>   if (copy_to_user(&links->pads[p], &pad, sizeof(pad)))
>   return -EFAULT;
> @@ -156,6 +158,7 @@ static long __media_device_enum_links(struct media_device 
> *mdev,
>   if (entity->links[l].source->entity != entity)
>   continue;
>  
> + memset(&link, 0, sizeof(link));
>   media_device_kpad_to_upad(entity->links[l].source,
> &link.source);
>   media_device_kpad_to_upad(entity->links[l].sink,
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[patch] [media] media: info leak in __media_device_enum_links()

[Dan Carpenter]

These structs have holes and reserved struct members which aren't
cleared.  I've added a memset() so we don't leak stack information.

Signed-off-by: Dan Carpenter 

diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index 99b80b6..450c0d1 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -139,6 +139,8 @@ static long __media_device_enum_links(struct media_device 
*mdev,
 
for (p = 0; p < entity->num_pads; p++) {
struct media_pad_desc pad;
+
+   memset(&pad, 0, sizeof(pad));
media_device_kpad_to_upad(&entity->pads[p], &pad);
if (copy_to_user(&links->pads[p], &pad, sizeof(pad)))
return -EFAULT;
@@ -156,6 +158,7 @@ static long __media_device_enum_links(struct media_device 
*mdev,
if (entity->links[l].source->entity != entity)
continue;
 
+   memset(&link, 0, sizeof(link));
media_device_kpad_to_upad(entity->links[l].source,
  &link.source);
media_device_kpad_to_upad(entity->links[l].sink,
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html