From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Tomas Bortoli <tomasbortoli@gmail.com>,
syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com,
Sean Young <sean@mess.org>,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 87/89] media: ttusb-dec: Fix info-leak in ttusb_dec_send_command()
Date: Sun, 22 Sep 2019 14:57:15 -0400 [thread overview]
Message-ID: <20190922185717.3412-87-sashal@kernel.org> (raw)
In-Reply-To: <20190922185717.3412-1-sashal@kernel.org>
From: Tomas Bortoli <tomasbortoli@gmail.com>
[ Upstream commit a10feaf8c464c3f9cfdd3a8a7ce17e1c0d498da1 ]
The function at issue does not always initialize each byte allocated
for 'b' and can therefore leak uninitialized memory to a USB device in
the call to usb_bulk_msg()
Use kzalloc() instead of kmalloc()
Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/ttusb-dec/ttusb_dec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
index cdefb5dfbbdcd..cad2746158160 100644
--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
@@ -330,7 +330,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
dprintk("%s\n", __func__);
- b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
+ b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
if (!b)
return -ENOMEM;
--
2.20.1
next prev parent reply other threads:[~2019-09-22 19:08 UTC|newest]
Thread overview: 89+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-22 18:55 [PATCH AUTOSEL 4.14 01/89] ALSA: hda: Flush interrupts on disabling Sasha Levin
2019-09-22 18:55 ` [PATCH AUTOSEL 4.14 02/89] regulator: lm363x: Fix off-by-one n_voltages for lm3632 ldo_vpos/ldo_vneg Sasha Levin
2019-09-22 18:55 ` [PATCH AUTOSEL 4.14 03/89] ASoC: sgtl5000: Fix charge pump source assignment Sasha Levin
2019-09-22 18:55 ` [PATCH AUTOSEL 4.14 04/89] dmaengine: bcm2835: Print error in case setting DMA mask fails Sasha Levin
2019-09-22 18:55 ` [PATCH AUTOSEL 4.14 05/89] leds: leds-lp5562 allow firmware files up to the maximum length Sasha Levin
2019-09-22 18:55 ` [PATCH AUTOSEL 4.14 06/89] media: dib0700: fix link error for dibx000_i2c_set_speed Sasha Levin
2019-09-22 18:55 ` [PATCH AUTOSEL 4.14 07/89] media: mtk-cir: lower de-glitch counter for rc-mm protocol Sasha Levin
2019-09-22 18:55 ` [PATCH AUTOSEL 4.14 08/89] media: exynos4-is: fix leaked of_node references Sasha Levin
2019-09-22 18:55 ` [PATCH AUTOSEL 4.14 09/89] media: hdpvr: Add device num check and handling Sasha Levin
2019-09-22 18:55 ` [PATCH AUTOSEL 4.14 10/89] media: i2c: ov5640: Check for devm_gpiod_get_optional() error Sasha Levin
2019-09-22 18:55 ` [PATCH AUTOSEL 4.14 11/89] sched/fair: Fix imbalance due to CPU affinity Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 12/89] sched/core: Fix CPU controller for !RT_GROUP_SCHED Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 13/89] x86/reboot: Always use NMI fallback when shutdown via reboot vector IPI fails Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 14/89] x86/apic: Soft disable APIC before initializing it Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 15/89] ALSA: hda - Show the fatal CORB/RIRB error more clearly Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 16/89] ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in build_adc_controls() Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 17/89] EDAC/mc: Fix grain_bits calculation Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 18/89] media: iguanair: add sanity checks Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 19/89] base: soc: Export soc_device_register/unregister APIs Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 20/89] ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 21/89] ia64:unwind: fix double free for mod->arch.init_unw_table Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 22/89] EDAC/altera: Use the proper type for the IRQ status bits Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 23/89] ASoC: rsnd: don't call clk_get_rate() under atomic context Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 24/89] md/raid1: end bio when the device faulty Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 25/89] md: don't call spare_active in md_reap_sync_thread if all member devices can't work Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 26/89] md: don't set In_sync if array is frozen Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 27/89] RAS: Fix prototype warnings Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 28/89] ACPI / processor: don't print errors for processorIDs == 0xff Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 29/89] EDAC, pnd2: Fix ioremap() size in dnv_rd_reg() Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 30/89] efi: cper: print AER info of PCIe fatal error Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 31/89] sched/fair: Use rq_lock/unlock in online_fair_sched_group Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 32/89] media: gspca: zero usb_buf on error Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 33/89] perf test vfs_getname: Disable ~/.perfconfig to get default output Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 34/89] media: mtk-mdp: fix reference count on old device tree Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 35/89] media: fdp1: Reduce FCP not found message level to debug Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 36/89] media: rc: imon: Allow iMON RC protocol for ffdc 7e device Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 37/89] dmaengine: iop-adma: use correct printk format strings Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 38/89] perf ftrace: Use CAP_SYS_ADMIN instead of euid==0 Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 39/89] perf record: Support aarch64 random socket_id assignment Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 40/89] media: i2c: ov5645: Fix power sequence Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 41/89] media: omap3isp: Don't set streaming state on random subdevs Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 42/89] media: imx: mipi csi-2: Don't fail if initial state times-out Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 43/89] net: lpc-enet: fix printk format strings Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 44/89] ARM: dts: imx7d: cl-som-imx7: make ethernet work again Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 45/89] media: radio/si470x: kill urb on error Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 46/89] media: hdpvr: add terminating 0 at end of string Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 47/89] nbd: add missing config put Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 48/89] media: dvb-core: fix a memory leak bug Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 49/89] libperf: Fix alignment trap with xyarray contents in 'perf stat' Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 50/89] EDAC/amd64: Recognize DRAM device type ECC capability Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 51/89] EDAC/amd64: Decode syndrome before translating address Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 52/89] PM / devfreq: passive: Use non-devm notifiers Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 53/89] PM / devfreq: exynos-bus: Correct clock enable sequence Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 54/89] media: cec-notifier: clear cec_adap in cec_notifier_unregister Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 55/89] media: saa7146: add cleanup in hexium_attach() Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 56/89] media: cpia2_usb: fix memory leaks Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 57/89] media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate() Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 58/89] perf trace beauty ioctl: Fix off-by-one error in cmd->string table Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 59/89] media: ov9650: add a sanity check Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 60/89] ASoC: es8316: fix headphone mixer volume table Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 61/89] ACPI / CPPC: do not require the _PSD method Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 62/89] arm64: kpti: ensure patched kernel text is fetched from PoU Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 63/89] nvmet: fix data units read and written counters in SMART log Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 64/89] iommu/amd: Silence warnings under memory pressure Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 65/89] iommu/iova: Avoid false sharing on fq_timer_on Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 66/89] libtraceevent: Change users plugin directory Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 67/89] ARM: dts: exynos: Mark LDO10 as always-on on Peach Pit/Pi Chromebooks Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 68/89] ACPI: custom_method: fix memory leaks Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 69/89] ACPI / PCI: fix acpi_pci_irq_enable() memory leak Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 70/89] hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap' Sasha Levin
2019-09-22 18:56 ` [PATCH AUTOSEL 4.14 71/89] md/raid1: fail run raid1 array when active disk less than one Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 72/89] dmaengine: ti: edma: Do not reset reserved paRAM slots Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 73/89] kprobes: Prohibit probing on BUG() and WARN() address Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 74/89] s390/crypto: xts-aes-s390 fix extra run-time crypto self tests finding Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 75/89] irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 76/89] x86/platform/uv: Fix kmalloc() NULL check routine Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 77/89] ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 78/89] raid5: don't set STRIPE_HANDLE to stripe which is in batch list Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 79/89] mmc: core: Clarify sdio_irq_pending flag for MMC_CAP2_SDIO_IRQ_NOTHREAD Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 80/89] mmc: sdhci: Fix incorrect switch to HS mode Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 81/89] raid5: don't increment read_errors on EILSEQ return Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 82/89] media: technisat-usb2: break out of loop at end of buffer Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 83/89] libertas: Add missing sentinel at end of if_usb.c fw_table Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 84/89] e1000e: add workaround for possible stalled packet Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 85/89] ALSA: hda - Drop unsol event handler for Intel HDMI codecs Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 86/89] drm/amd/powerplay/smu7: enforce minimal VBITimeout (v2) Sasha Levin
2019-09-22 18:57 ` Sasha Levin [this message]
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 88/89] ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93 Sasha Levin
2019-09-22 18:57 ` [PATCH AUTOSEL 4.14 89/89] btrfs: extent-tree: Make sure we only allocate extents from block groups with the same type Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190922185717.3412-87-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=sean@mess.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com \
--cc=tomasbortoli@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).