Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 886ccd45 authored by Vasiliy Kulikov's avatar Vasiliy Kulikov Committed by Greg Kroah-Hartman
Browse files

usb: core: fix information leak to userland 



Structure usbdevfs_connectinfo is copied to userland with padding byted
after "slow" field uninitialized.  It leads to leaking of contents of
kernel stack memory.

Signed-off-by: default avatarVasiliy Kulikov <segooon@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent eca67aae

drivers/usb/core/devio.c

+4 −3
Original line number Diff line number Diff line
@@ -965,10 +965,11 @@ static int proc_getdriver(struct dev_state *ps, void __user *arg) 


static int proc_connectinfo(struct dev_state *ps, void __user *arg)

{

	struct usbdevfs_connectinfo ci;

	struct usbdevfs_connectinfo ci = {

		.devnum = ps->dev->devnum,

		.slow = ps->dev->speed == USB_SPEED_LOW

	};



	ci.devnum = ps->dev->devnum;

	ci.slow = ps->dev->speed == USB_SPEED_LOW;

	if (copy_to_user(arg, &ci, sizeof(ci)))

		return -EFAULT;

	return 0;