Commit adf62df3 authored by Dan Rosenberg's avatar Dan Rosenberg Committed by Greg Kroah-Hartman

drivers/net/usb/hso.c: prevent reading uninitialized memory

commit 7011e660 upstream.

Fixed formatting (tabs and line breaks).

The TIOCGICOUNT device ioctl allows unprivileged users to read
uninitialized stack memory, because the "reserved" member of the
serial_icounter_struct struct declared on the stack in hso_get_count()
is not altered or zeroed before being copied back to the user.  This
patch takes care of it.
Signed-off-by: default avatarDan Rosenberg <dan.j.rosenberg@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 710acfd8
...@@ -1634,6 +1634,8 @@ static int hso_get_count(struct hso_serial *serial, ...@@ -1634,6 +1634,8 @@ static int hso_get_count(struct hso_serial *serial,
struct uart_icount cnow; struct uart_icount cnow;
struct hso_tiocmget *tiocmget = serial->tiocmget; struct hso_tiocmget *tiocmget = serial->tiocmget;
memset(&icount, 0, sizeof(struct serial_icounter_struct));
if (!tiocmget) if (!tiocmget)
return -ENOENT; return -ENOENT;
spin_lock_irq(&serial->serial_lock); spin_lock_irq(&serial->serial_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment