nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

usbip: prevent leaking socket pointer address in messages

Browse source 
usbip driver is leaking socket pointer address in messages. Remove
the messages that aren't useful and print sockfd in the ones that
are useful for debugging.

Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Shuah Khan 2017-12-15 10:50:09 -07:00 committed by Greg Kroah-Hartman
parent 248a220443
commit 90120d15f4
3 changed files with 7 additions and 14 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/usb/usbip/stub_dev.c
View file

@ -149,8 +149,7 @@ static void stub_shutdown_connection(struct usbip_device *ud)
* step 1?
*/
if (ud->tcp_socket) {
dev_dbg(&sdev->udev->dev, "shutdown tcp_socket %p\n",
ud->tcp_socket);
dev_dbg(&sdev->udev->dev, "shutdown sockfd %d\n", ud->sockfd);
kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR);
}

16
drivers/usb/usbip/usbip_common.c
View file

@ -317,26 +317,20 @@ int usbip_recv(struct socket *sock, void *buf, int size)
struct msghdr msg = {.msg_flags = MSG_NOSIGNAL};
int total = 0;
if (!sock || !buf || !size)
return -EINVAL;
iov_iter_kvec(&msg.msg_iter, READ|ITER_KVEC, &iov, 1, size);
usbip_dbg_xmit("enter\n");
if (!sock || !buf || !size) {
pr_err("invalid arg, sock %p buff %p size %d\n", sock, buf,
size);
return -EINVAL;
}
do {
int sz = msg_data_left(&msg);
msg_data_left(&msg);
sock->sk->sk_allocation = GFP_NOIO;
result = sock_recvmsg(sock, &msg, MSG_WAITALL);
if (result <= 0) {
pr_debug("receive sock %p buf %p size %u ret %d total %d\n",
sock, buf + total, sz, result, total);
if (result <= 0)
goto err;
}
total += result;
} while (msg_data_left(&msg));

2
drivers/usb/usbip/vhci_hcd.c
View file

@ -965,7 +965,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
/* need this? see stub_dev.c */
if (ud->tcp_socket) {
pr_debug("shutdown tcp_socket %p\n", ud->tcp_socket);
pr_debug("shutdown tcp_socket %d\n", ud->sockfd);
kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR);
}