* [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl()
@ 2013-11-07 8:09 ` Dan Carpenter
0 siblings, 0 replies; 8+ messages in thread
From: Dan Carpenter @ 2013-11-07 8:09 UTC (permalink / raw)
To: Takashi Iwai; +Cc: alsa-devel, kernel-janitors
There is a 2 byte hole after "info.func_nr" so we could leak unitialized
stack information to userspace.
Fixes: 1da177e4c3f4 ('Linux-2.6.12-rc2')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
index c1aa21e..48da227 100644
--- a/sound/isa/sb/sb16_csp.c
+++ b/sound/isa/sb/sb16_csp.c
@@ -208,6 +208,7 @@ static int snd_sb_csp_ioctl(struct snd_hwdep * hw, struct file *file, unsigned i
switch (cmd) {
/* get information */
case SNDRV_SB_CSP_IOCTL_INFO:
+ memset(&info, 0, sizeof(info));
*info.codec_name = *p->codec_name;
info.func_nr = p->func_nr;
info.acc_format = p->acc_format;
^ permalink raw reply related [flat|nested] 8+ messages in thread* [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl()
@ 2013-11-07 8:09 ` Dan Carpenter
0 siblings, 0 replies; 8+ messages in thread
From: Dan Carpenter @ 2013-11-07 8:09 UTC (permalink / raw)
To: Takashi Iwai; +Cc: alsa-devel, kernel-janitors
There is a 2 byte hole after "info.func_nr" so we could leak unitialized
stack information to userspace.
Fixes: 1da177e4c3f4 ('Linux-2.6.12-rc2')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
index c1aa21e..48da227 100644
--- a/sound/isa/sb/sb16_csp.c
+++ b/sound/isa/sb/sb16_csp.c
@@ -208,6 +208,7 @@ static int snd_sb_csp_ioctl(struct snd_hwdep * hw, struct file *file, unsigned i
switch (cmd) {
/* get information */
case SNDRV_SB_CSP_IOCTL_INFO:
+ memset(&info, 0, sizeof(info));
*info.codec_name = *p->codec_name;
info.func_nr = p->func_nr;
info.acc_format = p->acc_format;
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl()
2013-11-07 8:09 ` Dan Carpenter
@ 2013-11-07 8:48 ` Takashi Iwai
-1 siblings, 0 replies; 8+ messages in thread
From: Takashi Iwai @ 2013-11-07 8:48 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Jaroslav Kysela, alsa-devel, kernel-janitors
At Thu, 7 Nov 2013 11:09:54 +0300,
Dan Carpenter wrote:
>
> There is a 2 byte hole after "info.func_nr" so we could leak unitialized
> stack information to userspace.
>
> Fixes: 1da177e4c3f4 ('Linux-2.6.12-rc2')
Does this help at all? It means that the bug has been there even
before moving to git. I think it's better to be removed for avoid
confusion.
thanks,
Takashi
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
> index c1aa21e..48da227 100644
> --- a/sound/isa/sb/sb16_csp.c
> +++ b/sound/isa/sb/sb16_csp.c
> @@ -208,6 +208,7 @@ static int snd_sb_csp_ioctl(struct snd_hwdep * hw, struct file *file, unsigned i
> switch (cmd) {
> /* get information */
> case SNDRV_SB_CSP_IOCTL_INFO:
> + memset(&info, 0, sizeof(info));
> *info.codec_name = *p->codec_name;
> info.func_nr = p->func_nr;
> info.acc_format = p->acc_format;
>
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl()
@ 2013-11-07 8:48 ` Takashi Iwai
0 siblings, 0 replies; 8+ messages in thread
From: Takashi Iwai @ 2013-11-07 8:48 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Jaroslav Kysela, alsa-devel, kernel-janitors
At Thu, 7 Nov 2013 11:09:54 +0300,
Dan Carpenter wrote:
>
> There is a 2 byte hole after "info.func_nr" so we could leak unitialized
> stack information to userspace.
>
> Fixes: 1da177e4c3f4 ('Linux-2.6.12-rc2')
Does this help at all? It means that the bug has been there even
before moving to git. I think it's better to be removed for avoid
confusion.
thanks,
Takashi
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
> index c1aa21e..48da227 100644
> --- a/sound/isa/sb/sb16_csp.c
> +++ b/sound/isa/sb/sb16_csp.c
> @@ -208,6 +208,7 @@ static int snd_sb_csp_ioctl(struct snd_hwdep * hw, struct file *file, unsigned i
> switch (cmd) {
> /* get information */
> case SNDRV_SB_CSP_IOCTL_INFO:
> + memset(&info, 0, sizeof(info));
> *info.codec_name = *p->codec_name;
> info.func_nr = p->func_nr;
> info.acc_format = p->acc_format;
>
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl()
2013-11-07 8:48 ` Takashi Iwai
@ 2013-11-07 9:09 ` Dan Carpenter
-1 siblings, 0 replies; 8+ messages in thread
From: Dan Carpenter @ 2013-11-07 9:09 UTC (permalink / raw)
To: Takashi Iwai; +Cc: Jaroslav Kysela, alsa-devel, kernel-janitors
On Thu, Nov 07, 2013 at 09:48:08AM +0100, Takashi Iwai wrote:
> At Thu, 7 Nov 2013 11:09:54 +0300,
> Dan Carpenter wrote:
> >
> > There is a 2 byte hole after "info.func_nr" so we could leak unitialized
> > stack information to userspace.
> >
> > Fixes: 1da177e4c3f4 ('Linux-2.6.12-rc2')
>
> Does this help at all? It means that the bug has been there even
> before moving to git. I think it's better to be removed for avoid
> confusion.
I think if you are back porting it then you know it goes back all the
way. That seems useful.
The Fixes tag is still new so it's not totally clear what the rules are.
I don't have strong feelings about this either way.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl()
@ 2013-11-07 9:09 ` Dan Carpenter
0 siblings, 0 replies; 8+ messages in thread
From: Dan Carpenter @ 2013-11-07 9:09 UTC (permalink / raw)
To: Takashi Iwai; +Cc: Jaroslav Kysela, alsa-devel, kernel-janitors
On Thu, Nov 07, 2013 at 09:48:08AM +0100, Takashi Iwai wrote:
> At Thu, 7 Nov 2013 11:09:54 +0300,
> Dan Carpenter wrote:
> >
> > There is a 2 byte hole after "info.func_nr" so we could leak unitialized
> > stack information to userspace.
> >
> > Fixes: 1da177e4c3f4 ('Linux-2.6.12-rc2')
>
> Does this help at all? It means that the bug has been there even
> before moving to git. I think it's better to be removed for avoid
> confusion.
I think if you are back porting it then you know it goes back all the
way. That seems useful.
The Fixes tag is still new so it's not totally clear what the rules are.
I don't have strong feelings about this either way.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl()
2013-11-07 9:09 ` Dan Carpenter
@ 2013-11-07 9:17 ` Takashi Iwai
-1 siblings, 0 replies; 8+ messages in thread
From: Takashi Iwai @ 2013-11-07 9:17 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Jaroslav Kysela, alsa-devel, kernel-janitors
At Thu, 7 Nov 2013 12:09:47 +0300,
Dan Carpenter wrote:
>
> On Thu, Nov 07, 2013 at 09:48:08AM +0100, Takashi Iwai wrote:
> > At Thu, 7 Nov 2013 11:09:54 +0300,
> > Dan Carpenter wrote:
> > >
> > > There is a 2 byte hole after "info.func_nr" so we could leak unitialized
> > > stack information to userspace.
> > >
> > > Fixes: 1da177e4c3f4 ('Linux-2.6.12-rc2')
> >
> > Does this help at all? It means that the bug has been there even
> > before moving to git. I think it's better to be removed for avoid
> > confusion.
>
> I think if you are back porting it then you know it goes back all the
> way. That seems useful.
Yeah, I understand the usefulness of the tag. But my understanding is
that this is used for pointing a regression point. However, in this
particular case, the commit you pointed there isn't the actual commit
introducing the bug. It's the genesis commit containing everything.
> The Fixes tag is still new so it's not totally clear what the rules are.
> I don't have strong feelings about this either way.
OK, then let me drop that tag in this case.
thanks,
Takashi
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl()
@ 2013-11-07 9:17 ` Takashi Iwai
0 siblings, 0 replies; 8+ messages in thread
From: Takashi Iwai @ 2013-11-07 9:17 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Jaroslav Kysela, alsa-devel, kernel-janitors
At Thu, 7 Nov 2013 12:09:47 +0300,
Dan Carpenter wrote:
>
> On Thu, Nov 07, 2013 at 09:48:08AM +0100, Takashi Iwai wrote:
> > At Thu, 7 Nov 2013 11:09:54 +0300,
> > Dan Carpenter wrote:
> > >
> > > There is a 2 byte hole after "info.func_nr" so we could leak unitialized
> > > stack information to userspace.
> > >
> > > Fixes: 1da177e4c3f4 ('Linux-2.6.12-rc2')
> >
> > Does this help at all? It means that the bug has been there even
> > before moving to git. I think it's better to be removed for avoid
> > confusion.
>
> I think if you are back porting it then you know it goes back all the
> way. That seems useful.
Yeah, I understand the usefulness of the tag. But my understanding is
that this is used for pointing a regression point. However, in this
particular case, the commit you pointed there isn't the actual commit
introducing the bug. It's the genesis commit containing everything.
> The Fixes tag is still new so it's not totally clear what the rules are.
> I don't have strong feelings about this either way.
OK, then let me drop that tag in this case.
thanks,
Takashi
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2013-11-07 9:17 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-07 8:09 [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl() Dan Carpenter
2013-11-07 8:09 ` Dan Carpenter
2013-11-07 8:48 ` Takashi Iwai
2013-11-07 8:48 ` Takashi Iwai
2013-11-07 9:09 ` Dan Carpenter
2013-11-07 9:09 ` Dan Carpenter
2013-11-07 9:17 ` Takashi Iwai
2013-11-07 9:17 ` Takashi Iwai
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.