linux-kernel - Re: [PATCH 01/11] iio: temperature: tmp006: fix information leak in triggered buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <521fffbf-6de8-4ce5-8af1-45c4029c7e60@gmail.com>
Date: Mon, 2 Dec 2024 20:28:12 +0100
From: Javier Carrasco <javier.carrasco.cruz@...il.com>
To: Jonathan Cameron <jic23@...nel.org>, Lars-Peter Clausen
 <lars@...afoo.de>, Antoni Pokusinski <apokusinski01@...il.com>,
 Francesco Dolcini <francesco@...cini.it>,
 João Paulo Gonçalves <jpaulo.silvagoncalves@...il.com>
Cc: Jonathan Cameron <Jonathan.Cameron@...wei.com>,
 linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org,
 João Paulo Gonçalves <joao.goncalves@...adex.com>,
 Francesco Dolcini <francesco.dolcini@...adex.com>, stable@...r.kernel.org
Subject: Re: [PATCH 01/11] iio: temperature: tmp006: fix information leak in
 triggered buffer

On 25/11/2024 22:16, Javier Carrasco wrote:
> The 'scan' local struct is used to push data to user space from a
> triggered buffer, but it has a hole between the two 16-bit data channels
> and the timestamp. This hole is never initialized.
> 
> Initialize the struct to zero before using it to avoid pushing
> uninitialized information to userspace.
> 
> Cc: stable@...r.kernel.org
> Fixes: 91f75ccf9f03 ("iio: temperature: tmp006: add triggered buffer support")
> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@...il.com>
> ---
>  drivers/iio/temperature/tmp006.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
> index 0c844137d7aa..02b27f471baa 100644
> --- a/drivers/iio/temperature/tmp006.c
> +++ b/drivers/iio/temperature/tmp006.c
> @@ -252,6 +252,8 @@ static irqreturn_t tmp006_trigger_handler(int irq, void *p)
>  	} scan;
>  	s32 ret;
>  
> +	memset(&scan, 0, sizeof(scan));
> +
>  	ret = i2c_smbus_read_word_data(data->client, TMP006_VOBJECT);
>  	if (ret < 0)
>  		goto err;
> 

@Jonathan, this patch requires 91f75ccf9f03 ("iio: temperature: tmp006:
add triggered buffer support"), which is in the mainline kernel, but not
accessible from iio/fixes-to-greg.

Is there any branch in IIO where the fixes and the new features are put
together? I would like to rebase my series to automatically get rid of
the applied patches, but iio/fixes-to-greg (where the patches were
applied) does not have the feature this patch fixes. Of course I can
manually drop the applied patches, but that is error-prone.

This is not the first time I face this inconvenience, and I suppose
there is a cleaner way that I might be missing, or maybe that branch I
am looking for already exists.

Thanks and best regards,
Javier Carrasco