When a signal is delivered, the information in the siginfo structure
is copied to userspace. Good security practice dicatates that the
unused fields in this structure should be initialized to 0 so that
random kernel stack data isn't exposed to the user. This patch adds
such an initialization to the two places where usbfs raises signals.
Signed-off-by: Alan Stern <st...@rowland.harvard.edu>
Reported-by: Dave Mielke <d...@mielke.cc>
CC: <sta...@vger.kernel.org>
---
[as1776]
drivers/usb/core/devio.c | 2 ++
1 file changed, 2 insertions(+)
Index: usb-3.19/drivers/usb/core/devio.c
===================================================================
--- usb-3.19.orig/drivers/usb/core/devio.c
+++ usb-3.19/drivers/usb/core/devio.c
@@ -501,6 +501,7 @@ static void async_completed(struct urb *
as->status = urb->status;
signr = as->signr;
if (signr) {
+ memset(&sinfo, 0, sizeof(sinfo));
sinfo.si_signo = as->signr;
sinfo.si_errno = as->status;
sinfo.si_code = SI_ASYNCIO;
@@ -2382,6 +2383,7 @@ static void usbdev_remove(struct usb_dev
wake_up_all(&ps->wait);
list_del_init(&ps->list);
if (ps->discsignr) {
+ memset(&sinfo, 0, sizeof(sinfo));
sinfo.si_signo = ps->discsignr;
sinfo.si_errno = EPIPE;
sinfo.si_code = SI_ASYNCIO;
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
