commit 64a7de49b9e21b83d6b066e9cedc54c901e6efae
author Kangjie Lu <kangjielu@gmail.com> Tue May 03 16:44:07 2016 -0400
committer Mattias Nissler <mnissler@google.com> Wed Jul 20 16:18:42 2016 +0200
tree c605a68ab1d51058d316fe17315632ae54192d43
parent bd62548b9ca90f77b53c1b28618f092e33c45ea5

UPSTREAM: ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS

The stack object “tread” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Bug: None
Patchset: alsa-info-leak-fixes

(cherry-picked from cec8f96e49d9be372fdb0c3836dcf31ec71e457e)
Signed-off-by: Mattias Nissler <mnissler@google.com>

Change-Id: I6f1072552af4f189cec4ee5d85c6391cf8eb18a4

sound/core/timer.c

diff --git a/sound/core/timer.c b/sound/core/timer.c
index b982d1b..cfa3500 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1746,6 +1746,7 @@
 	if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) {
 		if (tu->tread) {
 			struct snd_timer_tread tread;
+			memset(&tread, 0, sizeof(tread));
 			tread.event = SNDRV_TIMER_EVENT_EARLY;
 			tread.tstamp.tv_sec = 0;
 			tread.tstamp.tv_nsec = 0;