]> git.baikalelectronics.ru Git - kernel.git/commit
Staging: bcm: Fix information leak in ioctl: IOCTL_BCM_REGISTER_READ_PRIVATE, IOCTL_B...
authorKevin McKinney <klmckinney1@gmail.com>
Sun, 6 Nov 2011 14:40:11 +0000 (09:40 -0500)
committerGreg Kroah-Hartman <gregkh@suse.de>
Sun, 27 Nov 2011 01:11:58 +0000 (17:11 -0800)
commit98704c3a64760c9dbcdd4f060bfb4b300163db48
tree37f8f318c8c02d890be2b77f3ad625a460ef14f5
parent0c325405e148dd14ce0f5efe442bd0fd3cedd42a
Staging: bcm: Fix information leak in ioctl: IOCTL_BCM_REGISTER_READ_PRIVATE, IOCTL_BCM_EEPROM_REGISTER_READ

This patch fixes an information leak in ioctl
IOCTL_BCM_REGISTER_READ_PRIVATE and
IOCTL_BCM_EEPROM_REGISTER_READ when determining
the number of bytes to copy to user space.  Function,
usb_control_msg, returns the correct number of
bytes from the hardware.  Instead of using
this value, we were using a value derived from
user space. In this case, this value could be more
than the hardware allocated.  Therefore, this
patch copies the proper number of bytes from
the hardware, and uses this value as the maximum
number of bytes for user space.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/staging/bcm/Bcmchar.c
drivers/staging/bcm/InterfaceDld.c
drivers/staging/bcm/InterfaceIdleMode.c
drivers/staging/bcm/InterfaceInit.c
drivers/staging/bcm/InterfaceMisc.c
drivers/staging/bcm/Misc.c
drivers/staging/bcm/nvm.c