Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

rose: fix info leak via msg_name in rose_recvmsg()

Browse source 
The code in rose_recvmsg() does not initialize all of the members of
struct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info.
Nor does it initialize the padding bytes of the structure inserted by
the compiler for alignment. This will lead to leaking uninitialized
kernel stack bytes in net/socket.c.

Fix the issue by initializing the memory used for sockaddr info with
memset(0).

Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Mathias Krause 2013-04-07 01:51:59 +00:00 committed by David S. Miller
parent d26d6504f2
commit 4a184233f2
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
net/rose/af_rose.c
View file

@ -1253,6 +1253,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
if (srose != NULL) { if (srose != NULL) {
memset(srose, 0, msg->msg_namelen);
srose->srose_family = AF_ROSE; srose->srose_family = AF_ROSE;
srose->srose_addr = rose->dest_addr; srose->srose_addr = rose->dest_addr;
srose->srose_call = rose->dest_call; srose->srose_call = rose->dest_call;