USB: usbfs: fix potential infoleak in devio 49/154949/1
authorKangjie Lu <kangjielu@gmail.com>
Fri, 15 Jul 2016 19:08:18 +0000 (15:08 -0400)
committerSeung-Woo Kim <sw0312.kim@samsung.com>
Wed, 11 Oct 2017 12:23:36 +0000 (21:23 +0900)
commitb69ed9d5c63d94d0c7c961c62d32760e9b64dfbd
treeb159883361572bbd476065c1081d9e026f3161d7
parent644ccb48eebb1c736f5cd314b094057fbdb0d6ee
USB: usbfs: fix potential infoleak in devio

commit 681fef8380eb818c0b845fca5d2ab1dcbab114ee upstream.

The stack object "ci" has a total size of 8 bytes. Its last 3 bytes
are padding bytes which are not initialized and leaked to userland
via "copy_to_user".

CVE-2016-4482

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ciwillia@brocade.com: backported to 3.10: adjusted context]
Signed-off-by: Charles (Chas) Williams <ciwillia@brocade.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
[sw0312.kim: cherry-pick from linux-3.10.y to fix CVE-2016-4482]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ibf7908f9e8e2dd06adc19c4867b884e59c68ae88
drivers/usb/core/devio.c