lkml.org 
[lkml]   [2005]   [Jul]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 20/29] USB: usbfs: Don't leak uninitialized data
    From: Alan Stern <stern@rowland.harvard.edu>

    This patch fixes an information leak in the usbfs snoop facility:
    uninitialized data from __get_free_page can be returned to userspace and
    written to the system log. It also improves the snoop output by printing
    the wLength value.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/usb/core/devio.c | 18 ++++++++++++------
    1 files changed, 12 insertions(+), 6 deletions(-)

    --- gregkh-2.6.orig/drivers/usb/core/devio.c 2005-07-29 11:29:48.000000000 -0700
    +++ gregkh-2.6/drivers/usb/core/devio.c 2005-07-29 11:36:28.000000000 -0700
    @@ -569,8 +569,11 @@
    free_page((unsigned long)tbuf);
    return -EINVAL;
    }
    - snoop(&dev->dev, "control read: bRequest=%02x bRrequestType=%02x wValue=%04x wIndex=%04x\n",
    - ctrl.bRequest, ctrl.bRequestType, ctrl.wValue, ctrl.wIndex);
    + snoop(&dev->dev, "control read: bRequest=%02x "
    + "bRrequestType=%02x wValue=%04x "
    + "wIndex=%04x wLength=%04x\n",
    + ctrl.bRequest, ctrl.bRequestType, ctrl.wValue,
    + ctrl.wIndex, ctrl.wLength);

    usb_unlock_device(dev);
    i = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), ctrl.bRequest, ctrl.bRequestType,
    @@ -579,11 +582,11 @@
    if ((i > 0) && ctrl.wLength) {
    if (usbfs_snoop) {
    dev_info(&dev->dev, "control read: data ");
    - for (j = 0; j < ctrl.wLength; ++j)
    + for (j = 0; j < i; ++j)
    printk ("%02x ", (unsigned char)(tbuf)[j]);
    printk("\n");
    }
    - if (copy_to_user(ctrl.data, tbuf, ctrl.wLength)) {
    + if (copy_to_user(ctrl.data, tbuf, i)) {
    free_page((unsigned long)tbuf);
    return -EFAULT;
    }
    @@ -595,8 +598,11 @@
    return -EFAULT;
    }
    }
    - snoop(&dev->dev, "control write: bRequest=%02x bRrequestType=%02x wValue=%04x wIndex=%04x\n",
    - ctrl.bRequest, ctrl.bRequestType, ctrl.wValue, ctrl.wIndex);
    + snoop(&dev->dev, "control write: bRequest=%02x "
    + "bRrequestType=%02x wValue=%04x "
    + "wIndex=%04x wLength=%04x\n",
    + ctrl.bRequest, ctrl.bRequestType, ctrl.wValue,
    + ctrl.wIndex, ctrl.wLength);
    if (usbfs_snoop) {
    dev_info(&dev->dev, "control write: data: ");
    for (j = 0; j < ctrl.wLength; ++j)
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-07-30 02:56    [W:0.027 / U:29.968 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site