浏览代码

ALSA: asihpi: fix kernel memory disclosure

Some elements in hr are not cleared before being copied to user space,
leaking kernel heap memory to user space. For example, this happens in
the error handling code for the HPI_ADAPTER_DELETE case. Zero the memory
before it's copied.

Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Vlad Tsyrklevich 8 年之前
父节点
当前提交
d69bb92e40
共有 1 个文件被更改,包括 1 次插入1 次删除
  1. 1 1
      sound/pci/asihpi/hpioctl.c

+ 1 - 1
sound/pci/asihpi/hpioctl.c

@@ -111,7 +111,7 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		return -EINVAL;
 
 	hm = kmalloc(sizeof(*hm), GFP_KERNEL);
-	hr = kmalloc(sizeof(*hr), GFP_KERNEL);
+	hr = kzalloc(sizeof(*hr), GFP_KERNEL);
 	if (!hm || !hr) {
 		err = -ENOMEM;
 		goto out;