diff options
| author | Vasiliy Kulikov <segooon@gmail.com> | 2010-11-06 17:41:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-12-09 13:26:55 -0800 |
| commit | 25281c78b18e69379f6e2a00c693417208e8b8a7 (patch) | |
| tree | 9ba188f92081b00220e281bf1a64b996c10cae04 /drivers/usb | |
| parent | 6909d43e26b098f79ea2300ddec56a7c39f5675e (diff) | |
usb: misc: iowarrior: fix information leak to userland
commit eca67aaeebd6e5d22b0d991af1dd0424dc703bfb upstream.
Structure iowarrior_info is copied to userland with padding byted
between "serial" and "revision" fields uninitialized. It leads to
leaking of contents of kernel stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/misc/iowarrior.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c index e75bb87ee92b..02ff0405d746 100644 --- a/drivers/usb/misc/iowarrior.c +++ b/drivers/usb/misc/iowarrior.c @@ -552,6 +552,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd, /* needed for power consumption */ struct usb_config_descriptor *cfg_descriptor = &dev->udev->actconfig->desc; + memset(&info, 0, sizeof(info)); /* directly from the descriptor */ info.vendor = le16_to_cpu(dev->udev->descriptor.idVendor); info.product = dev->product_id; |