Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit da281558 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

can: peak_usb: fix slab info leak 



commit f7a1337f0d29b98733c8824e165fca3371d7d4fd upstream.

Fix a small slab info leak due to a failure to clear the command buffer
at allocation.

The first 16 bytes of the command buffer are always sent to the device
in pcan_usb_send_cmd() even though only the first two may have been
initialised in case no argument payload is provided (e.g. when waiting
for a response).

Fixes: bb478555 ("can: usb: PEAK-System Technik USB adapters driver core")
Cc: stable <stable@vger.kernel.org>     # 3.4
Reported-by: default avatar <syzbot+863724e7128e14b26732@syzkaller.appspotmail.com>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b46a2067

drivers/net/can/usb/peak_usb/pcan_usb_core.c

+1 −1
Original line number Diff line number Diff line
@@ -774,7 +774,7 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter, 
	dev = netdev_priv(netdev);



	/* allocate a buffer large enough to send commands */

	dev->cmd_buf = kmalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL);

	dev->cmd_buf = kzalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL);

	if (!dev->cmd_buf) {

		err = -ENOMEM;

		goto lbl_free_candev;