HID: uhid: fix leak for 64/32 UHID_CREATE
authorDavid Herrmann <dh.herrmann@gmail.com>
Tue, 26 Nov 2013 12:58:18 +0000 (13:58 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 4 Dec 2013 18:57:15 +0000 (10:57 -0800)
commit5b80fd00af8b03e0b03ec52aec90485525eb2e73
tree2895b9bdbfdca88d1d98844c8078a1c509a92fc2
parent8e43aac1ec86b5955ecf396395f6fd8b4be42157
HID: uhid: fix leak for 64/32 UHID_CREATE

commit 80897aa787ecd58eabb29deab7cbec9249c9b7e6 upstream.

UHID allows short writes so user-space can omit unused fields. We
automatically set them to 0 in the kernel. However, the 64/32 bit
compat-handler didn't do that in the UHID_CREATE fallback. This will
reveal random kernel heap data (of random size, even) to user-space.

Fixes: befde0226a59 ('HID: uhid: make creating devices work on 64/32 systems')

Reported-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/hid/uhid.c