diff options
| author | Vasiliy Kulikov <segooon@gmail.com> | 2010-11-06 17:41:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-12-09 13:24:18 -0800 |
| commit | 82d1639ec939d83169f0b556a29c711e43a0290e (patch) | |
| tree | b661de12ef08d31b1e719b851de1f4eabe6e37dd | |
| parent | a4548d087ffaaecc406518cc3dfae2c92a28aea2 (diff) | |
usb: misc: iowarrior: fix information leak to userland
commit eca67aaeebd6e5d22b0d991af1dd0424dc703bfb upstream.
Structure iowarrior_info is copied to userland with padding byted
between "serial" and "revision" fields uninitialized. It leads to
leaking of contents of kernel stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/usb/misc/iowarrior.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c index a4ef77ef917d..2f75bb00dc11 100644 --- a/drivers/usb/misc/iowarrior.c +++ b/drivers/usb/misc/iowarrior.c @@ -551,6 +551,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd, /* needed for power consumption */ struct usb_config_descriptor *cfg_descriptor = &dev->udev->actconfig->desc; + memset(&info, 0, sizeof(info)); /* directly from the descriptor */ info.vendor = le16_to_cpu(dev->udev->descriptor.idVendor); info.product = dev->product_id; |