ALSA: asihpi: fix kernel memory disclosure
Some elements in hr are not cleared before being copied to user space, leaking kernel heap memory to user space. For example, this happens in the error handling code for the HPI_ADAPTER_DELETE case. Zero the memory before it's copied. Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Šī revīzija ir iekļauta:

revīziju iesūtīja
Takashi Iwai

vecāks
f771d5bb71
revīzija
d69bb92e40
@@ -111,7 +111,7 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
||||
return -EINVAL;
|
||||
|
||||
hm = kmalloc(sizeof(*hm), GFP_KERNEL);
|
||||
hr = kmalloc(sizeof(*hr), GFP_KERNEL);
|
||||
hr = kzalloc(sizeof(*hr), GFP_KERNEL);
|
||||
if (!hm || !hr) {
|
||||
err = -ENOMEM;
|
||||
goto out;
|
||||
|
Atsaukties uz šo jaunā problēmā
Block a user