usb: misc: iowarrior: fix information leak to userland

Structure iowarrior_info is copied to userland with padding byted between "serial" and "revision" fields uninitialized. It leads to leaking of contents of kernel stack memory.

Signed-off-by Vasiliy Kulikov <[email protected]>

---
Compile tested.

 drivers/usb/misc/iowarrior.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

drivers/usb/misc/iowarrior.c +1 -0

index 3756641..c9078e4 100644
@@ -553,6 +553,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
 			/* needed for power consumption */
 			struct usb_config_descriptor *cfg_descriptor = &dev->udev->actconfig->desc;
 
+			memset(&info, 0, sizeof(info));
 			/* directly from the descriptor */
 			info.vendor = le16_to_cpu(dev->udev->descriptor.idVendor);
 			info.product = dev->product_id;

Signature · 1 line

1.7.0.4