From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
Daniel Thompson <daniel.thompson@linaro.org>,
Gerd Hoffmann <kraxel@redhat.com>, Arnd Bergmann <arnd@arndb.de>,
Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>,
Jani Nikula <jani.nikula@intel.com>,
Daniel Vetter <daniel.vetter@ffwll.ch>,
linux-fbdev@vger.kernel.org, dri-devel@lists.freedesktop.org,
"Eric W. Biederman" <ebiederm@xmission.com>,
Andrew Morton <akpm@linux-foundation.org>,
Sam Ravnborg <sam@ravnborg.org>, Peter Rosin <peda@axentia.se>,
Dan Carpenter <dan.carpenter@oracle.com>,
Andrea Righi <righi.andrea@gmail.com>
Subject: [PATCH AUTOSEL 5.4 052/108] fbdev: potential information leak in do_fb_ioctl()
Date: Sat, 11 Apr 2020 19:08:47 -0400 [thread overview]
Message-ID: <20200411230943.24951-52-sashal@kernel.org> (raw)
In-Reply-To: <20200411230943.24951-1-sashal@kernel.org>
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit d3d19d6fc5736a798b118971935ce274f7deaa82 ]
The "fix" struct has a 2 byte hole after ->ywrapstep and the
"fix = info->fix;" assignment doesn't necessarily clear it. It depends
on the compiler. The solution is just to replace the assignment with an
memcpy().
Fixes: 1f5e31d7e55a ("fbmem: don't call copy_from/to_user() with mutex held")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andrea Righi <righi.andrea@gmail.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Cc: Peter Rosin <peda@axentia.se>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200113100132.ixpaymordi24n3av@kili.mountain
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/fbmem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index e6a1c805064f0..36469943795a8 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1110,7 +1110,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
break;
case FBIOGET_FSCREENINFO:
lock_fb_info(info);
- fix = info->fix;
+ memcpy(&fix, &info->fix, sizeof(fix));
if (info->flags & FBINFO_HIDE_SMEM_START)
fix.smem_start = 0;
unlock_fb_info(info);
--
2.20.1
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2020-04-11 23:10 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200411230943.24951-1-sashal@kernel.org>
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 012/108] drm/amd/display: Explicitly disable triplebuffer flips Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 022/108] drm/tegra: dc: Release PM and RGB output when client's registration fails Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 024/108] drm/amd/display: Stop if retimer is not available Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 026/108] drm/amd/display: writing stereo polarity register if swapped Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 029/108] drm/amd/display: Fix default logger mask definition Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 032/108] drm/amd/display: Only round InfoFrame refresh rates Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 042/108] drm/sun4i: dsi: Use NULL to signify "no panel" Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 048/108] drm/omap: fix possible object reference leak Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 051/108] drm/stm: ltdc: check crtc state before enabling LIE Sasha Levin
2020-04-11 23:08 ` Sasha Levin [this message]
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 053/108] drm/crc: Actually allow to change the crc source Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 054/108] drm/amdgpu: fix parentheses in amdgpu_vm_update_ptes Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 055/108] drm/amd/display: dc_get_vmid_use_vector() crashes when get called Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 061/108] drm/amd/display: dal_ddc_i2c_payloads_create can fail causing panic Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 062/108] drm/amd/display: System crashes when add_ptb_to_table() gets called Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 063/108] drm/omap: dss: Cleanup DSS ports on initialisation failure Sasha Levin
2020-04-11 23:09 ` [PATCH AUTOSEL 5.4 072/108] drm/msm: fix leaks if initialization fails Sasha Levin
2020-04-11 23:09 ` [PATCH AUTOSEL 5.4 073/108] drm/msm/a5xx: Always set an OPP supported hardware value Sasha Levin
2020-04-11 23:09 ` [PATCH AUTOSEL 5.4 074/108] drm/msm: devcoredump should dump MSM_SUBMIT_BO_DUMP buffers Sasha Levin
2020-04-11 23:09 ` [PATCH AUTOSEL 5.4 108/108] PCI: Use ioremap(), not phys_to_virt() for platform ROM Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200411230943.24951-52-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=arnd@arndb.de \
--cc=b.zolnierkie@samsung.com \
--cc=dan.carpenter@oracle.com \
--cc=daniel.thompson@linaro.org \
--cc=daniel.vetter@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=ebiederm@xmission.com \
--cc=jani.nikula@intel.com \
--cc=kraxel@redhat.com \
--cc=linux-fbdev@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=peda@axentia.se \
--cc=righi.andrea@gmail.com \
--cc=sam@ravnborg.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).