Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6b3f3f25 authored by Yaniv Gardi's avatar Yaniv Gardi Committed by David Keitel
Browse files

scsi: ufs: fix a possible kernel info leak to userspace 



This change fixes a possible info leak from kernel into userspace, since
two buffers were allocated with kmalloc() and never set their memory
region to 0.
Now, they are being allocated with kzalloc that fixes this issue

Change-Id: I23012ae8d3611c561511775362c3014b9a8be522
Signed-off-by: default avatarYaniv Gardi <ygardi@codeaurora.org>
parent 3281c7b7

drivers/scsi/ufs/ufshcd.c

+2 −2
Original line number Diff line number Diff line
@@ -5014,7 +5014,7 @@ static int ufshcd_query_ioctl(struct ufs_hba *hba, u8 lun, void __user *buffer) 
	u8 index;

	u8 *desc = NULL;



	ioctl_data = kmalloc(sizeof(struct ufs_ioctl_query_data), GFP_KERNEL);

	ioctl_data = kzalloc(sizeof(struct ufs_ioctl_query_data), GFP_KERNEL);

	if (!ioctl_data) {

		dev_err(hba->dev, "%s: Failed allocating %zu bytes\n", __func__,

				sizeof(struct ufs_ioctl_query_data));
@@ -5058,7 +5058,7 @@ static int ufshcd_query_ioctl(struct ufs_hba *hba, u8 lun, void __user *buffer) 
		}

		length = min_t(int, QUERY_DESC_MAX_SIZE,

				ioctl_data->buf_size);

		desc = kmalloc(length, GFP_KERNEL);

		desc = kzalloc(length, GFP_KERNEL);

		if (!desc) {

			dev_err(hba->dev, "%s: Failed allocating %d bytes\n",

					__func__, length);