Piteball/android_kernel_samsung_msm8976
1
1
Fork 0
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git synced 2024-10-31 18:09:19 +00:00
Code Issues Projects Releases Wiki Activity

ASoC: msm-lsm-client: use kzalloc instead of kmalloc

Browse source 
In the ioctl function, driver allocates memory to store data
internally before calling copy_to_user to copy data to user-space.
It is possible that kernel internal information can be leaked to
user space through this if the allocated memory is not completely
overwritten with valid data. Use kzalloc to fix this.

CRs-fixed: 2026045
Change-Id: I754ae2157034a135aaca4a15badf10d2567b7ed6
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
This commit is contained in:
Bhalchandra Gajare 2017-04-25 18:37:56 -07:00 committed by Gerrit - the friendly Code Review server
parent aef9dd9fdc
commit 53fea72ac3
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
sound/soc/msm/qdsp6v2/msm-lsm-client.c
View file

@ -1148,7 +1148,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
}
size = sizeof(*user) + userarg32.payload_size;
user = kmalloc(size, GFP_KERNEL);
user = kzalloc(size, GFP_KERNEL);
if (!user) {
dev_err(rtd->dev,
"%s: Allocation failed event status size %d\n",
@ -1169,7 +1169,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
err = -EFAULT;
}
if (!err) {
user32 = kmalloc(size, GFP_KERNEL);
user32 = kzalloc(size, GFP_KERNEL);
if (!user32) {
dev_err(rtd->dev,
"%s: Allocation event user status size %d\n",
@ -1582,7 +1582,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream,
size = sizeof(struct snd_lsm_event_status) +
userarg.payload_size;
user = kmalloc(size, GFP_KERNEL);
user = kzalloc(size, GFP_KERNEL);
if (!user) {
dev_err(rtd->dev,
"%s: Allocation failed event status size %d\n",