From patchwork Tue Nov 26 12:58:18 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Herrmann X-Patchwork-Id: 3238991 X-Patchwork-Delegate: jikos@jikos.cz Return-Path: X-Original-To: patchwork-linux-input@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 35AC5C045B for ; Tue, 26 Nov 2013 12:59:01 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 04F40203C4 for ; Tue, 26 Nov 2013 12:59:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CF81E203A3 for ; Tue, 26 Nov 2013 12:58:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753465Ab3KZM65 (ORCPT ); Tue, 26 Nov 2013 07:58:57 -0500 Received: from mail-ea0-f181.google.com ([209.85.215.181]:62441 "EHLO mail-ea0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752889Ab3KZM64 (ORCPT ); Tue, 26 Nov 2013 07:58:56 -0500 Received: by mail-ea0-f181.google.com with SMTP id m10so3475283eaj.26 for ; Tue, 26 Nov 2013 04:58:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=7nXV4tZamPYCMFLyiOHwzt/vQTDFFD3Exo71MpLS/tk=; b=zUk5YpGm8FX+KOOrKl5ZNRekM0hg6AUF3P/D1RPUjqOgTie9uH5wHdgPant9AVbxDd iVHFK72LBYUJ7IhKpSifZhlnBoO43moeoGKkOaQIDYxV6ASIo0Us/R19KbMa/QiYu16A n1iqIM5tDJOUoSGX7OtxKd2BZ3HDqNM1lkHUIKX9hWpxlRWJ+n3mRYaymXAu1ztoruSx F5jN8XzGC40a5fCR+jhVeXQ3Cgsius1g9dUErsvphYOSCMZh8cYxP2UNLgyF/AF8/fXS 82RfEHODWshXDAaRSw0zZ2Xx3lDb1btGp7OOQmhm2HalhSczCS63RTFyPO2eh6QPY46D YXyA== X-Received: by 10.14.32.134 with SMTP id o6mr123218eea.154.1385470735345; Tue, 26 Nov 2013 04:58:55 -0800 (PST) Received: from localhost.localdomain (stgt-5f71943b.pool.mediaWays.net. [95.113.148.59]) by mx.google.com with ESMTPSA id w6sm8792175eeo.12.2013.11.26.04.58.54 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Nov 2013 04:58:54 -0800 (PST) From: David Herrmann To: linux-input@vger.kernel.org Cc: Ben Hutchings , Jiri Kosina , David Herrmann , stable@vger.kernel.org Subject: [PATCH v2] HID: uhid: fix leak for 64/32 UHID_CREATE Date: Tue, 26 Nov 2013 13:58:18 +0100 Message-Id: <1385470698-6036-1-git-send-email-dh.herrmann@gmail.com> X-Mailer: git-send-email 1.8.4.2 In-Reply-To: <1385449330.23855.46.camel@deadeye.wl.decadent.org.uk> References: <1385449330.23855.46.camel@deadeye.wl.decadent.org.uk> Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP UHID allows short writes so user-space can omit unused fields. We automatically set them to 0 in the kernel. However, the 64/32 bit compat-handler didn't do that in the UHID_CREATE fallback. This will reveal random kernel heap data (of random size, even) to user-space. Reported-by: Ben Hutchings Signed-off-by: David Herrmann Cc: stable@vger.kernel.org --- drivers/hid/uhid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c index 93b00d7..cedc6da 100644 --- a/drivers/hid/uhid.c +++ b/drivers/hid/uhid.c @@ -287,7 +287,7 @@ static int uhid_event_from_user(const char __user *buffer, size_t len, */ struct uhid_create_req_compat *compat; - compat = kmalloc(sizeof(*compat), GFP_KERNEL); + compat = kzalloc(sizeof(*compat), GFP_KERNEL); if (!compat) return -ENOMEM;