diff mbox series

[5.4,65/88] USB: gadget: zero allocate endpoint 0 buffers

Message ID	20211213092935.506110613@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Szymon Heidrich <szymon.heidrich@gmail.com> Subject: [PATCH 5.4 65/88] USB: gadget: zero allocate endpoint 0 buffers Date: Mon, 13 Dec 2021 10:30:35 +0100 Message-Id: <20211213092935.506110613@linuxfoundation.org> In-Reply-To: <20211213092933.250314515@linuxfoundation.org> References: <20211213092933.250314515@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,03/88] HID: quirks: Add quirk for the Microsoft Surface 3 type-cover [5.4,05/88] HID: add hid_is_usb() function to make it simpler for USB detection [5.4,09/88] HID: bigbenff: prevent null pointer dereference [5.4,10/88] HID: wacom: fix problems when device is not a valid USB device [5.4,14/88] can: sja1000: fix use after free in ems_pcmcia_add_card() [5.4,16/88] selftests: netfilter: add a vrf+conntrack testcase [5.4,20/88] bonding: make tx_rebalance_counter an atomic [5.4,22/88] seg6: fix the iif in the IPv6 socket control block [5.4,23/88] udp: using datalen to cap max gso segments [5.4,26/88] IB/hfi1: Correct guard on eager buffer deallocation [5.4,28/88] ALSA: ctl: Fix copy of updated id with element read/write [5.4,31/88] ALSA: pcm: oss: Limit the period size to 16MB [5.4,32/88] ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() [5.4,34/88] btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling [5.4,35/88] nfsd: Fix nsfd startup race (again) [5.4,37/88] clk: qcom: regmap-mux: fix parent clock lookup [5.4,38/88] drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. [5.4,41/88] x86/sme: Explicitly map new EFI memmap table as encrypted [5.4,42/88] libata: add horkage for ASMedia 1092 [5.4,44/88] binder: use wake_up_pollfree() [5.4,46/88] aio: keep poll requests on waitqueue until completed [5.4,47/88] aio: fix use-after-free due to missing POLLFREE handling [5.4,48/88] tracefs: Set all files to the same group ownership as the mount option [5.4,49/88] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) [5.4,50/88] qede: validate non LSO skb length [5.4,51/88] ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer [5.4,52/88] i40e: Fix failed opcode appearing if handling messages from VF [5.4,53/88] i40e: Fix pre-set max number of queues for VF [5.4,54/88] mtd: rawnand: fsmc: Take instruction delay into account [5.4,55/88] mtd: rawnand: fsmc: Fix timing computation [5.4,56/88] dt-bindings: net: Reintroduce PHY no lane swap binding [5.4,57/88] tools build: Remove needless libpython-version feature check that breaks test-all fas... [5.4,59/88] net: altera: set a couple error code in probe() [5.4,62/88] net/qla3xxx: fix an error code in ql_adapter_up() [5.4,63/88] selftests/fib_tests: Rework fib_rp_filter_test() [5.4,65/88] USB: gadget: zero allocate endpoint 0 buffers [5.4,66/88] usb: core: config: fix validation of wMaxPacketValue entries [5.4,67/88] xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending [5.4,68/88] usb: core: config: using bit mask instead of individual bits [5.4,70/88] iio: trigger: Fix reference counting [5.4,73/88] iio: mma8452: Fix trigger reference couting [5.4,75/88] iio: kxsd9: Dont return error code in trigger handler [5.4,76/88] iio: itg3200: Call iio_trigger_notify_done() on error [5.4,77/88] iio: dln2-adc: Fix lockdep complaint [5.4,78/88] iio: dln2: Check return value of devm_iio_trigger_register() [5.4,79/88] iio: at91-sama5d2: Fix incorrect sign extension [5.4,80/88] iio: adc: axp20x_adc: fix charging current reporting on AXP22x [5.4,83/88] irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() [5.4,86/88] irqchip: nvic: Fix offset for Interrupt Priority Offsets

Commit Message

Greg Kroah-Hartman Dec. 13, 2021, 9:30 a.m. UTC

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86ebbc11bb3f60908a51f3e41a17e3f477c2eaa3 upstream.

Under some conditions, USB gadget devices can show allocated buffer
contents to a host.  Fix this up by zero-allocating them so that any
extra data will all just be zeros.

Reported-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Tested-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/composite.c   |    2 +-
 drivers/usb/gadget/legacy/dbgp.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff mbox series

Patch

--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2173,7 +2173,7 @@  int composite_dev_prepare(struct usb_com
 	if (!cdev->req)
 		return -ENOMEM;
 
-	cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL);
+	cdev->req->buf = kzalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL);
 	if (!cdev->req->buf)
 		goto fail;
 
--- a/drivers/usb/gadget/legacy/dbgp.c
+++ b/drivers/usb/gadget/legacy/dbgp.c
@@ -137,7 +137,7 @@  static int dbgp_enable_ep_req(struct usb
 		goto fail_1;
 	}
 
-	req->buf = kmalloc(DBGP_REQ_LEN, GFP_KERNEL);
+	req->buf = kzalloc(DBGP_REQ_LEN, GFP_KERNEL);
 	if (!req->buf) {
 		err = -ENOMEM;
 		stp = 2;