diff options
| author | Vasiliy Kulikov <segooon@gmail.com> | 2010-11-06 17:41:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-11-11 07:14:07 -0800 |
| commit | eca67aaeebd6e5d22b0d991af1dd0424dc703bfb (patch) | |
| tree | d2feaad27048cf110f868f5e0d5a1884c9bd14d7 | |
| parent | 5dc92cf1d0b4b0debbd2e333b83f9746c103533d (diff) | |
| download | op-kernel-dev-eca67aaeebd6e5d22b0d991af1dd0424dc703bfb.zip op-kernel-dev-eca67aaeebd6e5d22b0d991af1dd0424dc703bfb.tar.gz | |
usb: misc: iowarrior: fix information leak to userland
Structure iowarrior_info is copied to userland with padding byted
between "serial" and "revision" fields uninitialized. It leads to
leaking of contents of kernel stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Cc: stable <stable@kernel.org>
Acked-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/usb/misc/iowarrior.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c index 3756641..c9078e4 100644 --- a/drivers/usb/misc/iowarrior.c +++ b/drivers/usb/misc/iowarrior.c @@ -553,6 +553,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd, /* needed for power consumption */ struct usb_config_descriptor *cfg_descriptor = &dev->udev->actconfig->desc; + memset(&info, 0, sizeof(info)); /* directly from the descriptor */ info.vendor = le16_to_cpu(dev->udev->descriptor.idVendor); info.product = dev->product_id; |
