diff options
| author | Mark Brown <broonie@kernel.org> | 2020-08-25 13:01:46 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2020-08-25 13:01:46 +0300 |
| commit | 3bec5b6aae830355e786e204b20a7cea38c3a8ed (patch) | |
| tree | fd597b87faf55ceb2a207ee94f4feca6276696db /drivers/media/cec/core/cec-api.c | |
| parent | a577f3456c0a2fac3dee037c483753e6e68f3e49 (diff) | |
| parent | d012a7190fc1fd72ed48911e77ca97ba4521bccd (diff) | |
| download | linux-3bec5b6aae830355e786e204b20a7cea38c3a8ed.tar.xz | |
Merge tag 'v5.9-rc2' into regulator-5.9
Linux 5.9-rc2
Diffstat (limited to 'drivers/media/cec/core/cec-api.c')
| -rw-r--r-- | drivers/media/cec/core/cec-api.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c index 17d1cb2e5f97..f922a2196b2b 100644 --- a/drivers/media/cec/core/cec-api.c +++ b/drivers/media/cec/core/cec-api.c @@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap, struct cec_log_addrs log_addrs; mutex_lock(&adap->lock); - log_addrs = adap->log_addrs; + /* + * We use memcpy here instead of assignment since there is a + * hole at the end of struct cec_log_addrs that an assignment + * might ignore. So when we do copy_to_user() we could leak + * one byte of memory. + */ + memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs)); if (!adap->is_configured) memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID, sizeof(log_addrs.log_addr)); |