Merge branch 'stable-3.2' into pandora-3.2

[pandora-kernel.git] / drivers / staging / usbip / vhci_sysfs.c

diff --git a/drivers/staging/usbip/vhci_sysfs.c b/drivers/staging/usbip/vhci_sysfs.c
index 0cd039b..ae305d0 100644 (file)
--- a/drivers/staging/usbip/vhci_sysfs.c
+++ b/drivers/staging/usbip/vhci_sysfs.c
@@ -38,13 +38,18 @@ static ssize_t show_status(struct device *dev, struct device_attribute *attr,
 
        /*
         * output example:
-        * prt sta spd dev socket           local_busid
-        * 000 004 000 000         c5a7bb80 1-2.3
-        * 001 004 000 000         d8cee980 2-3.4
+        * prt sta spd dev sockfd    local_busid
+        * 000 004 000 000 3         1-2.3
+        * 001 004 000 000 4         2-3.4
+        *
+        * Output includes socket fd instead of socket pointer address to avoid
+        * leaking kernel memory address in:
+        *      /sys/devices/platform/vhci_hcd.0/status and in debug output.
+        * The socket pointer address is not used at the moment and it was made
+        * visible as a convenient way to find IP address from socket pointer
+        * address by looking up /proc/net/{tcp,tcp6}. As this opens a security
+        * hole, the change is made to use sockfd instead.
         *
-        * IP address can be retrieved from a socket pointer address by looking
-        * up /proc/net/{tcp,tcp6}. Also, a userland program may remember a
-        * port number and its peer IP address.
         */
        out += sprintf(out, "prt sta spd bus dev socket           "
                       "local_busid\n");
@@ -58,7 +63,7 @@ static ssize_t show_status(struct device *dev, struct device_attribute *attr,
                if (vdev->ud.status == VDEV_ST_USED) {
                        out += sprintf(out, "%03u %08x ",
                                       vdev->speed, vdev->devid);
-                       out += sprintf(out, "%16p ", vdev->ud.tcp_socket);
+                       out += sprintf(out, "%u", vdev->ud.sockfd);
                        out += sprintf(out, "%s", dev_name(&vdev->udev->dev));
 
                } else {
@@ -215,6 +220,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
 
        vdev->devid         = devid;
        vdev->speed         = speed;
+       vdev->ud.sockfd     = sockfd;
        vdev->ud.tcp_socket = socket;
        vdev->ud.status     = VDEV_ST_NOTASSIGNED;