[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <lsq.1402104389.665480053@decadent.org.uk>
Date: Sat, 07 Jun 2014 02:26:29 +0100
From: Ben Hutchings <ben@...adent.org.uk>
To: linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC: akpm@...ux-foundation.org,
"Laurent Pinchart" <laurent.pinchart@...asonboard.com>,
"Salva Peiró" <speiro@....upv.es>,
"Mauro Carvalho Chehab" <m.chehab@...sung.com>
Subject: [PATCH 3.2 44/92] [media] media-device: fix infoleak in ioctl
media_enum_entities()
3.2.60-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Salva Peiró <speiro@....upv.es>
commit e6a623460e5fc960ac3ee9f946d3106233fd28d8 upstream.
This fixes CVE-2014-1739.
Signed-off-by: Salva Peiró <speiro@....upv.es>
Acked-by: Laurent Pinchart <laurent.pinchart@...asonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@...sung.com>
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
drivers/media/media-device.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -90,6 +90,7 @@ static long media_device_enum_entities(s
struct media_entity *ent;
struct media_entity_desc u_ent;
+ memset(&u_ent, 0, sizeof(u_ent));
if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
return -EFAULT;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists