USB: usbfs: fix potential infoleak in devio
authorKangjie Lu <kangjielu@gmail.com>
Fri, 15 Jul 2016 19:08:18 +0000 (15:08 -0400)
committerWilly Tarreau <w@1wt.eu>
Sun, 21 Aug 2016 21:22:34 +0000 (23:22 +0200)
commitba3904ee86cb7072c2435883421b165dc1684bce
tree7e80dc0297275782177899441eeb842374a73b8c
parentbbb094201689b833910a5753fad2f46be2c78b67
USB: usbfs: fix potential infoleak in devio

commit 681fef8380eb818c0b845fca5d2ab1dcbab114ee upstream.

The stack object "ci" has a total size of 8 bytes. Its last 3 bytes
are padding bytes which are not initialized and leaked to userland
via "copy_to_user".

CVE-2016-4482

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ciwillia@brocade.com: backported to 3.10: adjusted context]
Signed-off-by: Charles (Chas) Williams <ciwillia@brocade.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/usb/core/devio.c