From mboxrd@z Thu Jan 1 00:00:00 1970 From: Takashi Iwai Subject: Re: [patch] ALSA: compress: info leak in snd_compr_get_caps() Date: Mon, 22 Apr 2013 10:42:25 +0200 Message-ID: References: <20130421110729.GA6171@elgon.mountain> Mime-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx2.suse.de (cantor2.suse.de [195.135.220.15]) by alsa0.perex.cz (Postfix) with ESMTP id A644C260304 for ; Mon, 22 Apr 2013 10:42:26 +0200 (CEST) In-Reply-To: <20130421110729.GA6171@elgon.mountain> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org To: Dan Carpenter Cc: alsa-devel@alsa-project.org, Vinod Koul , kernel-janitors@vger.kernel.org, Jeeja KP , Namarta Kohli List-Id: alsa-devel@alsa-project.org At Sun, 21 Apr 2013 14:07:29 +0300, Dan Carpenter wrote: > > If the ->get_caps() function doesn't clear the buffer then there would > stack information leaked to userspace. For example, > soc_compr_get_caps() can return success without clearing the buffer. Thanks, applied now. I found that we have also a similar problem in other ioctls (snd_compr_get_codec_caps() and snd_compr_get_params()), so applied the following patch in addition. Takashi --- From: Takashi Iwai Subject: [PATCH] ALSA: compress: Use kzalloc() for ioctls writing back data Like the previous patch by Dan, we should clear the data to be returned from certain compress ioctls, namely, snd_compr_get_codec_caps() and snd_compr_get_params(). This time, we can simply replace kmalloc() with kzalloc(). Signed-off-by: Takashi Iwai --- sound/core/compress_offload.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index 664c693..a0bc47f 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -428,7 +428,7 @@ snd_compr_get_codec_caps(struct snd_compr_stream *stream, unsigned long arg) if (!stream->ops->get_codec_caps) return -ENXIO; - caps = kmalloc(sizeof(*caps), GFP_KERNEL); + caps = kzalloc(sizeof(*caps), GFP_KERNEL); if (!caps) return -ENOMEM; @@ -545,7 +545,7 @@ snd_compr_get_params(struct snd_compr_stream *stream, unsigned long arg) if (!stream->ops->get_params) return -EBADFD; - params = kmalloc(sizeof(*params), GFP_KERNEL); + params = kzalloc(sizeof(*params), GFP_KERNEL); if (!params) return -ENOMEM; retval = stream->ops->get_params(stream, params); -- 1.8.2.1