Commit 77974fc2 authored by Arnaldo Carvalho de Melo's avatar Arnaldo Carvalho de Melo Committed by Greg Kroah-Hartman

[PATCH] leaking info on drivers/usb

I'm doing an audit wrt copy_to_user leaking info to userspace, started
with drivers/usb, please apply.
parent e18933e8
...@@ -2007,6 +2007,8 @@ static int usb_audio_ioctl_mixdev(struct inode *inode, struct file *file, unsign ...@@ -2007,6 +2007,8 @@ static int usb_audio_ioctl_mixdev(struct inode *inode, struct file *file, unsign
if (cmd == SOUND_MIXER_INFO) { if (cmd == SOUND_MIXER_INFO) {
mixer_info info; mixer_info info;
memset(&info, 0, sizeof(info));
strncpy(info.id, "USB_AUDIO", sizeof(info.id)); strncpy(info.id, "USB_AUDIO", sizeof(info.id));
strncpy(info.name, "USB Audio Class Driver", sizeof(info.name)); strncpy(info.name, "USB Audio Class Driver", sizeof(info.name));
info.modify_counter = ms->modcnt; info.modify_counter = ms->modcnt;
...@@ -2016,6 +2018,8 @@ static int usb_audio_ioctl_mixdev(struct inode *inode, struct file *file, unsign ...@@ -2016,6 +2018,8 @@ static int usb_audio_ioctl_mixdev(struct inode *inode, struct file *file, unsign
} }
if (cmd == SOUND_OLD_MIXER_INFO) { if (cmd == SOUND_OLD_MIXER_INFO) {
_old_mixer_info info; _old_mixer_info info;
memset(&info, 0, sizeof(info));
strncpy(info.id, "USB_AUDIO", sizeof(info.id)); strncpy(info.id, "USB_AUDIO", sizeof(info.id));
strncpy(info.name, "USB Audio Class Driver", sizeof(info.name)); strncpy(info.name, "USB Audio Class Driver", sizeof(info.name));
if (copy_to_user((void __user *)arg, &info, sizeof(info))) if (copy_to_user((void __user *)arg, &info, sizeof(info)))
......
...@@ -539,6 +539,7 @@ vicam_ioctl(struct inode *inode, struct file *file, unsigned int ioctlnr, unsign ...@@ -539,6 +539,7 @@ vicam_ioctl(struct inode *inode, struct file *file, unsigned int ioctlnr, unsign
struct video_capability b; struct video_capability b;
DBG("VIDIOCGCAP\n"); DBG("VIDIOCGCAP\n");
memset(&b, 0, sizeof(b));
strcpy(b.name, "ViCam-based Camera"); strcpy(b.name, "ViCam-based Camera");
b.type = VID_TYPE_CAPTURE; b.type = VID_TYPE_CAPTURE;
b.channels = 1; b.channels = 1;
......
...@@ -711,6 +711,7 @@ brlvger_ioctl(struct inode *inode, struct file *file, ...@@ -711,6 +711,7 @@ brlvger_ioctl(struct inode *inode, struct file *file,
case BRLVGER_GET_INFO: { case BRLVGER_GET_INFO: {
struct brlvger_info vi; struct brlvger_info vi;
memset(&vi, 0, sizeof(vi));
strlcpy(vi.driver_version, DRIVER_VERSION, strlcpy(vi.driver_version, DRIVER_VERSION,
sizeof(vi.driver_version)); sizeof(vi.driver_version));
strlcpy(vi.driver_banner, longbanner, strlcpy(vi.driver_banner, longbanner,
......
...@@ -1906,6 +1906,7 @@ static int edge_ioctl (struct usb_serial_port *port, struct file *file, unsigned ...@@ -1906,6 +1906,7 @@ static int edge_ioctl (struct usb_serial_port *port, struct file *file, unsigned
case TIOCGICOUNT: case TIOCGICOUNT:
cnow = edge_port->icount; cnow = edge_port->icount;
memset(&icount, 0, sizeof(icount));
icount.cts = cnow.cts; icount.cts = cnow.cts;
icount.dsr = cnow.dsr; icount.dsr = cnow.dsr;
icount.rng = cnow.rng; icount.rng = cnow.rng;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment