| Message ID | 20191018044701.4786-1-kjlu@umn.edu (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | d39083234c60519724c6ed59509a2129fd2aed41 |
| Delegated to: | Kieran Bingham |
| Headers | show |
| Series | media: rcar_drif: fix a memory disclosure | expand |
Hi Kangjie, On Sat, Oct 19, 2019 at 12:29 AM Kangjie Lu <kjlu@umn.edu> wrote: > "f->fmt.sdr.reserved" is uninitialized. As other peer drivers > like msi2500 and airspy do, the fix initializes it to avoid > memory disclosures. > > Signed-off-by: Kangjie Lu <kjlu@umn.edu> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> > --- a/drivers/media/platform/rcar_drif.c > +++ b/drivers/media/platform/rcar_drif.c > @@ -912,6 +912,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, > { > struct rcar_drif_sdr *sdr = video_drvdata(file); > > + memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); > f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; > f->fmt.sdr.buffersize = sdr->fmt->buffersize; I would do the memset() at the end, though, to follow declaration order of the struct members. Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds
diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c index 608e5217ccd5..0f267a237b42 100644 --- a/drivers/media/platform/rcar_drif.c +++ b/drivers/media/platform/rcar_drif.c @@ -912,6 +912,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, { struct rcar_drif_sdr *sdr = video_drvdata(file); + memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; f->fmt.sdr.buffersize = sdr->fmt->buffersize;
"f->fmt.sdr.reserved" is uninitialized. As other peer drivers like msi2500 and airspy do, the fix initializes it to avoid memory disclosures. Signed-off-by: Kangjie Lu <kjlu@umn.edu> --- drivers/media/platform/rcar_drif.c | 1 + 1 file changed, 1 insertion(+)