Skip to content

Commit b41c15f

Browse files
Dan Carpentertiwai
authored andcommitted
ALSA: bebob: potential info leak in hwdep_read()
The "count" variable needs to be capped on every path so that we don't copy too much information to the user. Fixes: 618eabe ("ALSA: bebob: Add hwdep interface") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20201007074928.GA2529578@mwanda Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent ca18435 commit b41c15f

1 file changed

Lines changed: 1 addition & 2 deletions

File tree

sound/firewire/bebob/bebob_hwdep.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,11 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
3636
}
3737

3838
memset(&event, 0, sizeof(event));
39+
count = min_t(long, count, sizeof(event.lock_status));
3940
if (bebob->dev_lock_changed) {
4041
event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
4142
event.lock_status.status = (bebob->dev_lock_count > 0);
4243
bebob->dev_lock_changed = false;
43-
44-
count = min_t(long, count, sizeof(event.lock_status));
4544
}
4645

4746
spin_unlock_irq(&bebob->lock);

0 commit comments

Comments
 (0)