Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5316c772 authored by Kangjie Lu's avatar Kangjie Lu Committed by Amit Pundir
Browse files

UPSTREAM: USB: usbfs: fix potential infoleak in devio 



(cherry pick from commit 681fef8380eb818c0b845fca5d2ab1dcbab114ee)

The stack object “ci” has a total size of 8 bytes. Its last 3 bytes
are padding bytes which are not initialized and leaked to userland
via “copy_to_user”.

Signed-off-by: default avatarKangjie Lu <kjlu@gatech.edu>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 28619695
Change-Id: I170754d659d0891c075f85211b5e3970b114f097
parent 1a4f1f28

drivers/usb/core/devio.c

+5 −4
Original line number Diff line number Diff line
@@ -1203,10 +1203,11 @@ static int proc_getdriver(struct usb_dev_state *ps, void __user *arg) 


static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)

{

	struct usbdevfs_connectinfo ci = {

		.devnum = ps->dev->devnum,

		.slow = ps->dev->speed == USB_SPEED_LOW

	};

	struct usbdevfs_connectinfo ci;



	memset(&ci, 0, sizeof(ci));

	ci.devnum = ps->dev->devnum;

	ci.slow = ps->dev->speed == USB_SPEED_LOW;



	if (copy_to_user(arg, &ci, sizeof(ci)))

		return -EFAULT;