| Message ID | tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 625fa77151f00c1bd00d34d60d6f2e710b3f9aad |
| Headers | show |
| Series | [v4] USB: usbtmc: prevent kernel-usb-infoleak | expand |
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index 619123e24c41..7866ea6dad37 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -754,7 +754,7 @@ static struct urb *usbtmc_create_urb(void) if (!urb) return NULL; - dmabuf = kmalloc(bufsize, GFP_KERNEL); + dmabuf = kzalloc(bufsize, GFP_KERNEL); if (!dmabuf) { usb_free_urb(urb); return NULL;
The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write") Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- V1 -> V2: Only clear uninitialized bytes after header and data V2 -> V3: Update condition and comments V3 -> V4: Use kzalloc to clear up dmabuf drivers/usb/class/usbtmc.c | 1 + 1 file changed, 1 insertion(+)