staging: dream: fix information leak to userland

PATCH In review Vasiliy Kulikov 4 participants 8 messages Oct 28, 2010 – Oct 29, 2010

Subsystems (3)

Arm Qualcomm mailing list Staging Kernel janitors

lore

Share & tools

lore

Vasiliy Kulikov

author

2010-10-28 20:01 UTC #0 lore raw

PATCH 1/8 staging: dream: fix information leak to userland

Structure msm_audio_stats is copied to userland with some fields unitialized. It leads to leaking of contents of kernel stack memory.
Also struct msm_audio_config has field "unused" of type array of 3 elements, not 4. Instead of this, initialize field "type".

Signed-off-by Vasiliy Kulikov <[email protected]>

---
 drivers/staging/dream/qdsp5/audio_aac.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

drivers/staging/dream/qdsp5/audio_aac.c +2 -1

index 45f4c78..b058c24 100644
@@ -589,6 +589,7 @@ static long audio_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
 	if (cmd = AUDIO_GET_STATS) {
 		struct msm_audio_stats stats;
+		memset(&stats, 0, sizeof(stats));
 		stats.byte_count = audpp_avsync_byte_count(audio->dec_id);
 		stats.sample_count = audpp_avsync_sample_count(audio->dec_id);
 		if (copy_to_user((void *)arg, &stats, sizeof(stats)))

@@ -664,10 +665,10 @@ static long audio_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 			} else {
 				config.channel_count = 2;
 			}
+			config.type = 0;
 			config.unused[0] = 0;
 			config.unused[1] = 0;
 			config.unused[2] = 0;
-			config.unused[3] = 0;
 			if (copy_to_user((void *)arg, &config,
 					 sizeof(config)))
 				rc = -EFAULT;

Signature · 1 line

1.7.0.4

Greg KH

2010-10-28 20:45 UTC #1 lore raw

Quoted 8 lines · Vasiliy Kulikov

Structure msm_audio_stats is copied to userland with some fields unitialized. It leads to leaking of contents of kernel stack memory.
Also struct msm_audio_config has field "unused" of type array of 3 elements, not 4. Instead of this, initialize field "type".
Signed-off-by Vasiliy Kulikov <[email protected]>
---
 drivers/staging/dream/qdsp5/audio_aac.c |    3 ++-

{sigh}

I'd really like to just drop this whole driver as I feel it's _way_ behind whatever anyone is really using "in the wild".

Actually, I doubt that anyone even uses this thing, do they?

Any objection to me just dropping the drivers/staging/dream/ tree? People should be working on the chipset-specific driver tree here instead, right?

Pavel, it looks like you're not doing any dream work anymore, any problems with me dropping it?

thanks,

greg k-h

Pavel Machek

2010-10-28 20:58 UTC #2 lore raw

Hi!

Quoted 9 lines

Quoted 8 lines
Structure msm_audio_stats is copied to userland with some fields unitialized. It leads to leaking of contents of kernel stack memory.
Also struct msm_audio_config has field "unused" of type array of 3 elements, not 4. Instead of this, initialize field "type".
Signed-off-by Vasiliy Kulikov <[email protected]>
---
 drivers/staging/dream/qdsp5/audio_aac.c |    3 ++-

Quoted 6 lines

{sigh}
I'd really like to just drop this whole driver as I feel it's _way_ behind whatever anyone is really using "in the wild".
Actually, I doubt that anyone even uses this thing, do they?

Not sure, you should definitely talk to codeaurora folks.

Quoted 3 lines

Any objection to me just dropping the drivers/staging/dream/ tree? People should be working on the chipset-specific driver tree here instead, right?

codeaurora people should know...

Quoted 2 lines

Pavel, it looks like you're not doing any dream work anymore, any problems with me dropping it?

Too busy to do any real work on Dream, sorry :-(.
Pavel

Signature · 2 lines

(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Greg KH

2010-10-28 21:08 UTC #3 lore raw

Quoted 18 lines · Pavel Machek

Hi!
Quoted 9 lines
Quoted 8 lines
Structure msm_audio_stats is copied to userland with some fields unitialized. It leads to leaking of contents of kernel stack memory.
Also struct msm_audio_config has field "unused" of type array of 3 elements, not 4. Instead of this, initialize field "type".
Signed-off-by Vasiliy Kulikov <[email protected]>
---
 drivers/staging/dream/qdsp5/audio_aac.c |    3 ++-
Quoted 6 lines
{sigh}
I'd really like to just drop this whole driver as I feel it's _way_ behind whatever anyone is really using "in the wild".
Actually, I doubt that anyone even uses this thing, do they?

Quoted 7 lines

Not sure, you should definitely talk to codeaurora folks.
Quoted 3 lines
Any objection to me just dropping the drivers/staging/dream/ tree? People should be working on the chipset-specific driver tree here instead, right?
codeaurora people should know...

Which specific ones? No one seems to be contributing to the drivers/staging/dream/ anymore, and there are a number of out-of-tree dream trees floating around now.

Quoted 4 lines

Quoted 2 lines
Pavel, it looks like you're not doing any dream work anymore, any problems with me dropping it?
Too busy to do any real work on Dream, sorry :-(.

Ok, I think I'll just drop it unless someone screams.

thanks,

greg k-h

Bryan Huntsman

2010-10-29 01:32 UTC #4 lore raw

Quoted 10 lines

Quoted 4 lines
Quoted 2 lines
Pavel, it looks like you're not doing any dream work anymore, any problems with me dropping it?
Too busy to do any real work on Dream, sorry :-(.
Ok, I think I'll just drop it unless someone screams.
thanks,
greg k-h

Greg, I'll check around internally and see if there are any concerns about dropping it. I'll get back to you soon. Thanks.

- Bryan

Signature · 2 lines

Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

Greg KH

2010-10-29 01:38 UTC #5 lore raw

Quoted 5 lines · Bryan Huntsman

Quoted 5 lines
Quoted 4 lines
Quoted 2 lines
Pavel, it looks like you're not doing any dream work anymore, any problems with me dropping it?
Too busy to do any real work on Dream, sorry :-(.

Quoted 8 lines

Quoted 5 lines
Ok, I think I'll just drop it unless someone screams.
thanks,
greg k-h
Greg, I'll check around internally and see if there are any concerns about dropping it. I'll get back to you soon. Thanks.

Wonderful, thanks for doing this.

greg k-h

Bryan Huntsman

2010-10-29 18:27 UTC #6 lore raw

Quoted 7 lines

Quoted 3 lines
Greg, I'll check around internally and see if there are any concerns about dropping it. I'll get back to you soon. Thanks.
Wonderful, thanks for doing this.
greg k-h

No concerns from us. Feel free to drop it. Thanks.

- Bryan

Signature · 2 lines

Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

Greg KH

2010-10-29 19:40 UTC #7 lore raw

Quoted 9 lines · Bryan Huntsman

Quoted 7 lines
Quoted 3 lines
Greg, I'll check around internally and see if there are any concerns about dropping it. I'll get back to you soon. Thanks.
Wonderful, thanks for doing this.
greg k-h
No concerns from us. Feel free to drop it. Thanks.

Great, will do, thanks for letting me know.

greg k-h