Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

can: peak_usb: fix slab info leak

Fix a small slab info leak due to a failure to clear the command buffer
at allocation.

The first 16 bytes of the command buffer are always sent to the device
in pcan_usb_send_cmd() even though only the first two may have been
initialised in case no argument payload is provided (e.g. when waiting
for a response).

Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
Cc: stable <stable@vger.kernel.org> # 3.4
Reported-by: syzbot+863724e7128e14b26732@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

authored by

Johan Hovold and committed by
Marc Kleine-Budde
f7a1337f de280f40

+1 -1
+1 -1
drivers/net/can/usb/peak_usb/pcan_usb_core.c
··· 750 750 dev = netdev_priv(netdev); 751 751 752 752 /* allocate a buffer large enough to send commands */ 753 - dev->cmd_buf = kmalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL); 753 + dev->cmd_buf = kzalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL); 754 754 if (!dev->cmd_buf) { 755 755 err = -ENOMEM; 756 756 goto lbl_free_candev;