| Message ID | 1385470698-6036-1-git-send-email-dh.herrmann@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Delegated to: | Jiri Kosina |
| Headers | show |
On Tue, 2013-11-26 at 13:58 +0100, David Herrmann wrote: > UHID allows short writes so user-space can omit unused fields. We > automatically set them to 0 in the kernel. However, the 64/32 bit > compat-handler didn't do that in the UHID_CREATE fallback. This will > reveal random kernel heap data (of random size, even) to user-space. > > Reported-by: Ben Hutchings <ben@decadent.org.uk> > Signed-off-by: David Herrmann <dh.herrmann@gmail.com> > Cc: stable@vger.kernel.org Fixes: befde0226a59 ('HID: uhid: make creating devices work on 64/32 systems') (that should make it clear which versions need the fix) > --- > drivers/hid/uhid.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c > index 93b00d7..cedc6da 100644 > --- a/drivers/hid/uhid.c > +++ b/drivers/hid/uhid.c > @@ -287,7 +287,7 @@ static int uhid_event_from_user(const char __user *buffer, size_t len, > */ > struct uhid_create_req_compat *compat; > > - compat = kmalloc(sizeof(*compat), GFP_KERNEL); > + compat = kzalloc(sizeof(*compat), GFP_KERNEL); > if (!compat) > return -ENOMEM; >
On Tue, 26 Nov 2013, Ben Hutchings wrote: > On Tue, 2013-11-26 at 13:58 +0100, David Herrmann wrote: > > UHID allows short writes so user-space can omit unused fields. We > > automatically set them to 0 in the kernel. However, the 64/32 bit > > compat-handler didn't do that in the UHID_CREATE fallback. This will > > reveal random kernel heap data (of random size, even) to user-space. > > > > Reported-by: Ben Hutchings <ben@decadent.org.uk> > > Signed-off-by: David Herrmann <dh.herrmann@gmail.com> > > Cc: stable@vger.kernel.org > > Fixes: befde0226a59 ('HID: uhid: make creating devices work on 64/32 systems') > > (that should make it clear which versions need the fix) Thanks a lot, applied with the Fixes: annotation added.
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c index 93b00d7..cedc6da 100644 --- a/drivers/hid/uhid.c +++ b/drivers/hid/uhid.c @@ -287,7 +287,7 @@ static int uhid_event_from_user(const char __user *buffer, size_t len, */ struct uhid_create_req_compat *compat; - compat = kmalloc(sizeof(*compat), GFP_KERNEL); + compat = kzalloc(sizeof(*compat), GFP_KERNEL); if (!compat) return -ENOMEM;
UHID allows short writes so user-space can omit unused fields. We automatically set them to 0 in the kernel. However, the 64/32 bit compat-handler didn't do that in the UHID_CREATE fallback. This will reveal random kernel heap data (of random size, even) to user-space. Reported-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Cc: stable@vger.kernel.org --- drivers/hid/uhid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)