linux-kernel - Re: [PATCH][next] media: v4l2-core: fix uninitialized structure fields being returned to userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAK8P3a0bJdKiX+=OMgCgmF158zEdgW9jYL85WqHWefhFk=ZF8Q@mail.gmail.com>
Date:   Tue, 7 Jan 2020 15:17:36 +0100
From:   Arnd Bergmann <arnd@...db.de>
To:     Colin King <colin.king@...onical.com>
Cc:     Mauro Carvalho Chehab <mchehab+huawei@...nel.org>,
        Hans Verkuil <hverkuil-cisco@...all.nl>,
        Linux Media Mailing List <linux-media@...r.kernel.org>,
        kernel-janitors@...r.kernel.org,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH][next] media: v4l2-core: fix uninitialized structure
 fields being returned to userspace

On Tue, Jan 7, 2020 at 3:02 PM Colin King <colin.king@...onical.com> wrote:
>
> From: Colin Ian King <colin.king@...onical.com>
>
> In the case where v4l2_event_dequeue fails the structure ev is not
> being filled and this garbage data from the stack is being copied
> to the ev32 structure and being copied back to userspace on the
> VIDIOC_DQEVENT_TIME32 ioctl.  Fix this by ensuring the ev structure
> is zero'd to ensure uninitialized data is not leaked back.
>
> Addresses-Coverity: ("Uninitialized scalar variable")
> Fixes: 1a6c0b36dd19 ("media: v4l2-core: fix VIDIOC_DQEVENT for time64 ABI")
> Signed-off-by: Colin Ian King <colin.king@...onical.com>

Good catch, thanks for fixing!

Acked-by: Arnd Bergmann <arnd@...db.de>

> ---
>  drivers/media/v4l2-core/v4l2-subdev.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
> index de926e311348..a376b351135f 100644
> --- a/drivers/media/v4l2-core/v4l2-subdev.c
> +++ b/drivers/media/v4l2-core/v4l2-subdev.c
> @@ -394,7 +394,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg)
>
>         case VIDIOC_DQEVENT_TIME32: {
>                 struct v4l2_event_time32 *ev32 = arg;
> -               struct v4l2_event ev;
> +               struct v4l2_event ev = { };
>
>                 if (!(sd->flags & V4L2_SUBDEV_FL_HAS_EVENTS))
>                         return -ENOIOCTLCMD;
> --
> 2.24.0
>