From: Vasiliy Kulikov <segooon@gmail.com>
Date: Sat, 6 Nov 2010 14:41:28 +0000 (+0300)
Subject: usb: core: fix information leak to userland
X-Git-Tag: firefly_0821_release~10186^2~680
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=2ca6e919e77473fb15a7437b3772a25e2a7ab1fb;p=firefly-linux-kernel-4.4.55.git

usb: core: fix information leak to userland

commit 886ccd4520064408ce5876cfe00554ce52ecf4a7 upstream.

Structure usbdevfs_connectinfo is copied to userland with padding byted
after "slow" field uninitialized.  It leads to leaking of contents of
kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 2f12e2da0e98..582aa87c4b0d 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -946,10 +946,11 @@ static int proc_getdriver(struct dev_state *ps, void __user *arg)
 
 static int proc_connectinfo(struct dev_state *ps, void __user *arg)
 {
-	struct usbdevfs_connectinfo ci;
+	struct usbdevfs_connectinfo ci = {
+		.devnum = ps->dev->devnum,
+		.slow = ps->dev->speed == USB_SPEED_LOW
+	};
 
-	ci.devnum = ps->dev->devnum;
-	ci.slow = ps->dev->speed == USB_SPEED_LOW;
 	if (copy_to_user(arg, &ci, sizeof(ci)))
 		return -EFAULT;
 	return 0;