| From ffeee83aa0461992e8a99a59db2df31933e60362 Mon Sep 17 00:00:00 2001 |
| From: Heinrich Schuchardt <xypron.glpk@gmx.de> |
| Date: Sun, 8 May 2016 23:20:59 +0200 |
| Subject: usb: gadget: avoid exposing kernel stack |
| |
| From: Heinrich Schuchardt <xypron.glpk@gmx.de> |
| |
| commit ffeee83aa0461992e8a99a59db2df31933e60362 upstream. |
| |
| Function in_rq_cur copies random bytes from the stack. |
| Zero the memory instead. |
| |
| Fixes: 132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver") |
| Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> |
| Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/gadget/function/f_uac2.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/drivers/usb/gadget/function/f_uac2.c |
| +++ b/drivers/usb/gadget/function/f_uac2.c |
| @@ -1291,6 +1291,7 @@ in_rq_cur(struct usb_function *fn, const |
| |
| if (control_selector == UAC2_CS_CONTROL_SAM_FREQ) { |
| struct cntrl_cur_lay3 c; |
| + memset(&c, 0, sizeof(struct cntrl_cur_lay3)); |
| |
| if (entity_id == USB_IN_CLK_ID) |
| c.dCUR = p_srate; |
