cec-api: prevent leaking memory through hole in structure

[ Upstream commit 6c42227c3467549ddc65efe99c869021d2f4a570 ]

Fix this smatch warning:

drivers/media/cec/core/cec-api.c:156 cec_adap_g_log_addrs() warn: check that 'log_addrs' doesn't leak information (struct has a hole after
'features')

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
index 4961573850d549b224a6241cbdaf77acae0198e1..b2b3f779592fd35d3506ed9f9f7c0a8ea22974c1 100644 (file)
--- a/drivers/media/cec/cec-api.c
+++ b/drivers/media/cec/cec-api.c
@@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap,
        struct cec_log_addrs log_addrs;
 
        mutex_lock(&adap->lock);
-       log_addrs = adap->log_addrs;
+       /*
+        * We use memcpy here instead of assignment since there is a
+        * hole at the end of struct cec_log_addrs that an assignment
+        * might ignore. So when we do copy_to_user() we could leak
+        * one byte of memory.
+        */
+       memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs));
        if (!adap->is_configured)
                memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID,
                       sizeof(log_addrs.log_addr));