projects
/
firefly-linux-kernel-4.4.55.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
1a4f1f2
)
UPSTREAM: USB: usbfs: fix potential infoleak in devio
author
Kangjie Lu
<kangjielu@gmail.com>
Tue, 3 May 2016 20:32:16 +0000
(16:32 -0400)
committer
Amit Pundir
<amit.pundir@linaro.org>
Mon, 11 Jul 2016 07:13:04 +0000
(12:43 +0530)
(cherry pick from commit
681fef8380eb818c0b845fca5d2ab1dcbab114ee
)
The stack object “ci” has a total size of 8 bytes. Its last 3 bytes
are padding bytes which are not initialized and leaked to userland
via “copy_to_user”.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug:
28619695
Change-Id: I170754d659d0891c075f85211b5e3970b114f097
drivers/usb/core/devio.c
patch
|
blob
|
history
diff --git
a/drivers/usb/core/devio.c
b/drivers/usb/core/devio.c
index 38ae877c46e3124eb07c2a46ddd33bc66ac54d93..3ffb01ff654978a9aa7f5ba62317a23a95aecade 100644
(file)
--- a/
drivers/usb/core/devio.c
+++ b/
drivers/usb/core/devio.c
@@
-1203,10
+1203,11
@@
static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
{
- struct usbdevfs_connectinfo ci = {
- .devnum = ps->dev->devnum,
- .slow = ps->dev->speed == USB_SPEED_LOW
- };
+ struct usbdevfs_connectinfo ci;
+
+ memset(&ci, 0, sizeof(ci));
+ ci.devnum = ps->dev->devnum;
+ ci.slow = ps->dev->speed == USB_SPEED_LOW;
if (copy_to_user(arg, &ci, sizeof(ci)))
return -EFAULT;