[alsa-devel] [PATCH] sound/pci/rme9652: prevent reading uninitialized stack memory

[Takashi Iwai]

At Sat, 25 Sep 2010 11:07:27 -0400,
Dan Rosenberg wrote:
> 
> The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
> SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
> unprivileged users to read uninitialized kernel stack memory, because
> several fields of the hdsp{m}_config_info structs declared on the stack
> are not altered or zeroed before being copied back to the user.  This
> patch takes care of it.
> 
> Signed-off-by: Dan Rosenberg <dan.j.rosenberg at gmail.com>

Thanks, applied now with minor optimization (memset outside
spinlock).


Takashi


> diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c linux-2.6.35.5/sound/pci/rme9652/hdsp.c
> --- linux-2.6.35.5.orig/sound/pci/rme9652/hdsp.c	2010-09-20 16:59:09.000000000 -0400
> +++ linux-2.6.35.5/sound/pci/rme9652/hdsp.c	2010-09-25 10:59:42.000000000 -0400
> @@ -4601,6 +4601,8 @@ static int snd_hdsp_hwdep_ioctl(struct s
>  		unsigned long flags;
>  		int i;
>  
> +		memset(&info, 0, sizeof(info));
> +
>  		err = hdsp_check_for_iobox(hdsp);
>  		if (err < 0)
>  			return err;
> diff -urp linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c linux-2.6.35.5/sound/pci/rme9652/hdspm.c
> --- linux-2.6.35.5.orig/sound/pci/rme9652/hdspm.c	2010-09-20 16:59:09.000000000 -0400
> +++ linux-2.6.35.5/sound/pci/rme9652/hdspm.c	2010-09-25 10:58:44.000000000 -0400
> @@ -4128,6 +4128,9 @@ static int snd_hdspm_hwdep_ioctl(struct 
>  	case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO:
>  
>  		spin_lock_irq(&hdspm->lock);
> +		
> +		memset(&info, 0, sizeof(info));
> +		
>  		info.pref_sync_ref = hdspm_pref_sync_ref(hdspm);
>  		info.wordclock_sync_check = hdspm_wc_sync_check(hdspm);
>  
> 
>