Skip to content

Commit

Permalink
ALSA: bebob: potential info leak in hwdep_read()
Browse files Browse the repository at this point in the history
The "count" variable needs to be capped on every path so that we don't
copy too much information to the user.

Fixes: 618eabe ("ALSA: bebob: Add hwdep interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201007074928.GA2529578@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Dan Carpenter authored and Takashi Iwai committed Oct 7, 2020
1 parent ca18435 commit b41c15f
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions sound/firewire/bebob/bebob_hwdep.c
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,11 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
}

memset(&event, 0, sizeof(event));
count = min_t(long, count, sizeof(event.lock_status));
if (bebob->dev_lock_changed) {
event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
event.lock_status.status = (bebob->dev_lock_count > 0);
bebob->dev_lock_changed = false;

count = min_t(long, count, sizeof(event.lock_status));
}

spin_unlock_irq(&bebob->lock);
Expand Down

0 comments on commit b41c15f

Please sign in to comment.