Received: by 2002:a25:b323:0:0:0:0:0 with SMTP id l35csp3142264ybj; Mon, 23 Sep 2019 15:39:08 -0700 (PDT) X-Google-Smtp-Source: APXvYqzkOyJQBR1q+Vyxq5iz3/nIULgKyhZpfy9Rsd/ih6Q+aVeEP+XnaUXvXT2gNz731CEcHz/R X-Received: by 2002:a05:6402:713:: with SMTP id w19mr2541356edx.126.1569278348401; Mon, 23 Sep 2019 15:39:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1569278348; cv=none; d=google.com; s=arc-20160816; b=AK9sZ869Fi1Y0d1C1wtDwkYzT6COdCwOSePg2IMatAUY2KQXGEBfyuoL8t4wUvWjjB clzKrMFylXXvdB2T7Fm2m+GW9okEh2bBhBm90juPZ/X+lXTBRCbsNmLnNPPkleL3gzak 76cxJQo7rMV0V9EjbfeK0ei8uIJou17ByBUGUbvOs8xvT45COhBtMsMUSPvaubTt0kPp hMCYt2/DpvT4YIKWQF9f12E2tgImhAu7QolL3XPK+3Tj9Bx6YJgRda/gqML++n1aecki /VBHUYgd0bsD8ZlIIb3bC8bIB47kPUYiOfNcXI91bTMDgeUKklvrkz28KByfYoSlXP9h K6sw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=ZgMlRePntpzqdprfseXYuWV6gJZX0dhyzmHaLou26CE=; b=MuB7D72k/1jj9A0NeOV1W1vcHyIKVtYB0sSrNS2Ahpqa7IYcobgfiYgj7mhE9O3EXR 5k7R91PmJhiQt6y3/1SDVVQREU5LQPVzHwZIHZ9EunAejT3PGOBZZIn77blswklhD8UQ 8nHQVkL6JusJmVGCptZyLejJFyc6fAhF2LIqPOGH2FNyRVhKZH8+NMVWz4Z8YBaFPrUL ev2gc582hnn00rN11hKMZUXrjPRyWpXMCYGJA5otm8hxf3j1BxxrYER5rIt6j14AoYEe azv0rYwRxHv8HW2r42exRImzC5xUIlGr2wmYJIbvFvmDMCjyXDdp0lYp9mcGoOnZ9Ww4 m9mw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Xq153oXO; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b1si7661254edm.271.2019.09.23.15.38.45; Mon, 23 Sep 2019 15:39:08 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Xq153oXO; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2392340AbfIVSt1 (ORCPT + 99 others); Sun, 22 Sep 2019 14:49:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:46108 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2392024AbfIVStH (ORCPT ); Sun, 22 Sep 2019 14:49:07 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id ABB7421479; Sun, 22 Sep 2019 18:49:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1569178146; bh=3vz0jGokF/tADKiAtasvrTU/In2SROOiBNXQon2ojrc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Xq153oXOi7DhKNjj+BkRCZ7vvF+wbQr3SMIkkALfm5y0J4mz4FdP9o8FW0FPpi6EE MKgYib18JfwtcY9ATtkNo1V2O+xehaMcxIhoDIluxJ5VUEdWO1JF5Y4YLv29A4or7b nti6D/rG7rTqDiKORHzvBj/gwinc1gukxL3ySwI4= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Tomas Bortoli , syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com, Sean Young , Mauro Carvalho Chehab , Sasha Levin , linux-media@vger.kernel.org Subject: [PATCH AUTOSEL 5.3 194/203] media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() Date: Sun, 22 Sep 2019 14:43:40 -0400 Message-Id: <20190922184350.30563-194-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190922184350.30563-1-sashal@kernel.org> References: <20190922184350.30563-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tomas Bortoli [ Upstream commit a10feaf8c464c3f9cfdd3a8a7ce17e1c0d498da1 ] The function at issue does not always initialize each byte allocated for 'b' and can therefore leak uninitialized memory to a USB device in the call to usb_bulk_msg() Use kzalloc() instead of kmalloc() Signed-off-by: Tomas Bortoli Reported-by: syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/usb/ttusb-dec/ttusb_dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c index 1d0afa340f47c..3198f9624b7c0 100644 --- a/drivers/media/usb/ttusb-dec/ttusb_dec.c +++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c @@ -319,7 +319,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, dprintk("%s\n", __func__); - b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); + b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); if (!b) return -ENOMEM; -- 2.20.1