Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d31dbf6e authored by Vasiliy Kulikov's avatar Vasiliy Kulikov Committed by Gustavo Padovan
Browse files

Bluetooth: hidp: fix information leak to userland 



Structure hidp_conninfo is copied to userland with version, product,
vendor and name fields unitialized if both session->input and session->hid
are NULL.  It leads to leaking of contents of kernel stack memory.

Signed-off-by: default avatarVasiliy Kulikov <segooon@gmail.com>
Acked-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarGustavo F. Padovan <padovan@profusion.mobi>
parent 3185fbd9

net/bluetooth/hidp/core.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -107,6 +107,7 @@ static void __hidp_unlink_session(struct hidp_session *session) 




static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)

static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)

{

{

	memset(ci, 0, sizeof(*ci));

	bacpy(&ci->bdaddr, &session->bdaddr);

	bacpy(&ci->bdaddr, &session->bdaddr);





	ci->flags = session->flags;

	ci->flags = session->flags;
@@ -115,7 +116,6 @@ static void __hidp_copy_session(struct hidp_session *session, struct hidp_connin 
	ci->vendor  = 0x0000;

	ci->vendor  = 0x0000;

	ci->product = 0x0000;

	ci->product = 0x0000;

	ci->version = 0x0000;

	ci->version = 0x0000;

	memset(ci->name, 0, 128);





	if (session->input) {

	if (session->input) {

		ci->vendor  = session->input->id.vendor;

		ci->vendor  = session->input->id.vendor;