Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1393788
| Path | csiph.com!news.mixmin.net!aioe.org!gothmog.csi.it!bofh.it!news.nic.it!robomod |
|---|---|
| From | Kangjie Lu <kangjielu@gmail.com> |
| Newsgroups | linux.kernel |
| Subject | [PATCH] fix infoleak in devio |
| Date | Tue, 03 May 2016 22:30:03 +0200 |
| Message-ID | <ruP7d-6xa-33@gated-at.bofh.it> (permalink) |
| X-Original-To | gregkh@linuxfoundation.org |
| Dkim-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=nVQN144/4qUGu3EynuAYLbvubqeBelp60EHvSqNB4Pc=; b=PphY2DijGAl5vkJMi+ZqpT/KZpflkXtpVUlOl646B6xtF15/7rKo45VbX6rtsrvA6b uHU2SNJBGx3tia8hYgJ4h4BDFRCd3iAtLefQooP4KAJELPJJmu9qnIVGL03OdsLgTOAd IIwWD8Wi4axPFEdyMhv92j+bY9wOArZ4hFpHC2jCWhTH6dZNKJ26IEOu8cJY+kifiCdl T0Iyr3eARGe1tc0F1709A5ik8HWXAPLt1veZ0UCylMnkNMK2pGpRBf/JzbheWbSqhvNp 60UqVxKU0pFAfhjEbpe5YXMRvkasdUloUxOZcLIkBWo+65RdSLYnH71zIPP2WqQgo1WQ fxhA== |
| X-Google-Dkim-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=nVQN144/4qUGu3EynuAYLbvubqeBelp60EHvSqNB4Pc=; b=mv5i+SkquSY/1mW3/aql1gnya8VW/84Wz8E0Abl1PtWhPGlNwMD//bwfFpYTw/L9Eh oauKc/QJdxhcUZXPgfxZuuFwK0hSXlWXSgf5kp1NKy7eF0jLHheQ9Pc+Oj/6iNO/2C6H OMA/DYNQv0O7sPQ0/LTpJRgon3H5t6XfQg6l0YyJ9ElUopihv105vl0I0DnW2N7rF33g GCiAcx3mchMpsr64xFVWRsCPlVlZcmwLjzi0Ed+ytcJ7ycfxSDkWu41o+y9wiCMmB71K 1YuArD8yElfkkr57PKviTEtsNfewOPiy91o2hvdDozsqcPRC7Vka3Lq2rsdzEN4mbm95 H3iA== |
| X-Gm-Message-State | AOPr4FW2P9vWg/GoMlhNW1ynju9v8p1cHiWQcr2PcAF68RLA1Ho7xvwxFTHsjtkvu66r9w== |
| X-Received | by 10.129.156.88 with SMTP id t85mr2466557ywg.4.1462307355368; Tue, 03 May 2016 13:29:15 -0700 (PDT) |
| X-Google-Original-From | Kangjie Lu <kjlu@gatech.edu> |
| X-Mailer | git-send-email 1.9.1 |
| MIME-Version | 1.0 |
| Content-Type | text/plain; charset=UTF-8 |
| Content-Transfer-Encoding | 8bit |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 31 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | stern@rowland.harvard.edu, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, taesoo@gatech.edu, insu@gatech.edu, Kangjie Lu <kjlu@gatech.edu> |
| X-Original-Date | Tue, 3 May 2016 16:32:16 -0400 |
| X-Original-Message-ID | <1462307536-5780-1-git-send-email-kjlu@gatech.edu> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| Xref | csiph.com linux.kernel:1393788 |
Show key headers only | View raw
The stack object “ci” has a total size of 8 bytes. Its last 3 bytes
are padding bytes which are not initialized and leaked to userland
via “copy_to_user”.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
---
drivers/usb/core/devio.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 52c4461..9b7f1f7 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1316,10 +1316,11 @@ static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
{
- struct usbdevfs_connectinfo ci = {
- .devnum = ps->dev->devnum,
- .slow = ps->dev->speed == USB_SPEED_LOW
- };
+ struct usbdevfs_connectinfo ci;
+
+ memset(&ci, 0, sizeof(ci));
+ ci.devnum = ps->dev->devnum;
+ ci.slow = ps->dev->speed == USB_SPEED_LOW;
if (copy_to_user(arg, &ci, sizeof(ci)))
return -EFAULT;
--
1.9.1
Back to linux.kernel | Previous | Next | Find similar | Unroll thread
[PATCH] fix infoleak in devio Kangjie Lu <kangjielu@gmail.com> - 2016-05-03 22:30 +0200
csiph-web