USB: gadget: mbim: Avoid copying uninitialized data to userspace
A race condition bug in function 'mbim_bind_config' allows to
change 'mbim->xport' type to invalid value. This allows
mbim_ioctl() to copy the uninitialized data to userspace. Fix
this by avoiding copy_to_user() call when transport type is invalid.
Change-Id: If8e8b6d4e2c347e1aff529bed0a798128eaea07c
CRs-Fixed: 1102418
Signed-off-by:
Arumuga Durai A <cadurai@codeaurora.org>
Loading
Please register or sign in to comment