diff options
| author | Vasiliy Kulikov <segooon@gmail.com> | 2010-11-06 17:41:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-12-09 13:33:05 -0800 |
| commit | 737b96b8f3def0a8d10ee792cb12ba8d0f7a2317 (patch) | |
| tree | 7118d747ce1cb5c9acdb6d52c62a11c08e711dc5 /drivers/usb/misc | |
| parent | e1e1f7573e7703a4e5a87a40671c5b42f70c429c (diff) | |
usb: misc: iowarrior: fix information leak to userland
commit eca67aaeebd6e5d22b0d991af1dd0424dc703bfb upstream.
Structure iowarrior_info is copied to userland with padding byted
between "serial" and "revision" fields uninitialized. It leads to
leaking of contents of kernel stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/misc')
| -rw-r--r-- | drivers/usb/misc/iowarrior.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c index bc88c79875a1..0db05b252e3b 100644 --- a/drivers/usb/misc/iowarrior.c +++ b/drivers/usb/misc/iowarrior.c @@ -553,6 +553,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd, /* needed for power consumption */ struct usb_config_descriptor *cfg_descriptor = &dev->udev->actconfig->desc; + memset(&info, 0, sizeof(info)); /* directly from the descriptor */ info.vendor = le16_to_cpu(dev->udev->descriptor.idVendor); info.product = dev->product_id; |