diff options
| author | Kevin McKinney | 2011-11-06 15:40:11 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2011-11-27 02:11:58 +0100 |
| commit | 41c7b7c0fa2f68afb1154e88597ff6b9b97334cf (patch) | |
| tree | 37f8f318c8c02d890be2b77f3ad625a460ef14f5 /drivers/staging/bcm/InterfaceMisc.c | |
| parent | Staging: bcm: hostmibs: Added temporary variable to shorten lines (diff) | |
| download | kernel-qcow2-linux-41c7b7c0fa2f68afb1154e88597ff6b9b97334cf.tar.gz kernel-qcow2-linux-41c7b7c0fa2f68afb1154e88597ff6b9b97334cf.tar.xz kernel-qcow2-linux-41c7b7c0fa2f68afb1154e88597ff6b9b97334cf.zip | |
Staging: bcm: Fix information leak in ioctl: IOCTL_BCM_REGISTER_READ_PRIVATE, IOCTL_BCM_EEPROM_REGISTER_READ
This patch fixes an information leak in ioctl
IOCTL_BCM_REGISTER_READ_PRIVATE and
IOCTL_BCM_EEPROM_REGISTER_READ when determining
the number of bytes to copy to user space. Function,
usb_control_msg, returns the correct number of
bytes from the hardware. Instead of using
this value, we were using a value derived from
user space. In this case, this value could be more
than the hardware allocated. Therefore, this
patch copies the proper number of bytes from
the hardware, and uses this value as the maximum
number of bytes for user space.
Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/bcm/InterfaceMisc.c')
| -rw-r--r-- | drivers/staging/bcm/InterfaceMisc.c | 24 |
1 files changed, 11 insertions, 13 deletions
diff --git a/drivers/staging/bcm/InterfaceMisc.c b/drivers/staging/bcm/InterfaceMisc.c index 61f878b4f56c..2218faeaf8ac 100644 --- a/drivers/staging/bcm/InterfaceMisc.c +++ b/drivers/staging/bcm/InterfaceMisc.c @@ -5,7 +5,7 @@ INT InterfaceRDM(PS_INTERFACE_ADAPTER psIntfAdapter, PVOID buff, INT len) { - int retval = 0; + int bytes; USHORT usRetries = 0; if (psIntfAdapter == NULL) { @@ -30,7 +30,7 @@ INT InterfaceRDM(PS_INTERFACE_ADAPTER psIntfAdapter, psIntfAdapter->psAdapter->DeviceAccess = TRUE; do { - retval = usb_control_msg(psIntfAdapter->udev, + bytes = usb_control_msg(psIntfAdapter->udev, usb_rcvctrlpipe(psIntfAdapter->udev, 0), 0x02, 0xC2, @@ -41,22 +41,20 @@ INT InterfaceRDM(PS_INTERFACE_ADAPTER psIntfAdapter, 5000); usRetries++; - if (-ENODEV == retval) { + if (-ENODEV == bytes) { psIntfAdapter->psAdapter->device_removed = TRUE; break; } - } while ((retval < 0) && (usRetries < MAX_RDM_WRM_RETIRES)); + } while ((bytes < 0) && (usRetries < MAX_RDM_WRM_RETIRES)); - if (retval < 0) { - BCM_DEBUG_PRINT(psIntfAdapter->psAdapter, DBG_TYPE_OTHERS, RDM, DBG_LVL_ALL, "RDM failed status :%d, retires :%d", retval, usRetries); - psIntfAdapter->psAdapter->DeviceAccess = FALSE; - return retval; - } else { - BCM_DEBUG_PRINT(psIntfAdapter->psAdapter, DBG_TYPE_OTHERS, RDM, DBG_LVL_ALL, "RDM sent %d", retval); - psIntfAdapter->psAdapter->DeviceAccess = FALSE; - return STATUS_SUCCESS; - } + if (bytes < 0) + BCM_DEBUG_PRINT(psIntfAdapter->psAdapter, DBG_TYPE_OTHERS, RDM, DBG_LVL_ALL, "RDM failed status :%d, retires :%d", bytes, usRetries); + else + BCM_DEBUG_PRINT(psIntfAdapter->psAdapter, DBG_TYPE_OTHERS, RDM, DBG_LVL_ALL, "RDM sent %d", bytes); + + psIntfAdapter->psAdapter->DeviceAccess = FALSE; + return bytes; } INT InterfaceWRM(PS_INTERFACE_ADAPTER psIntfAdapter, |