summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMathias Krause <minipli@googlemail.com>2013-04-07 01:51:59 +0000
committerDavid S. Miller <davem@davemloft.net>2013-04-07 16:28:02 -0400
commit4a184233f21645cf0b719366210ed445d1024d72 (patch)
treee42640b4410b0a4d19ae8b8fb3b767bd73e70a16
parentd26d6504f23e803824e8ebd14e52d4fc0a0b09cb (diff)
downloadop-kernel-dev-4a184233f21645cf0b719366210ed445d1024d72.zip
op-kernel-dev-4a184233f21645cf0b719366210ed445d1024d72.tar.gz
rose: fix info leak via msg_name in rose_recvmsg()
The code in rose_recvmsg() does not initialize all of the members of struct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info. Nor does it initialize the padding bytes of the structure inserted by the compiler for alignment. This will lead to leaking uninitialized kernel stack bytes in net/socket.c. Fix the issue by initializing the memory used for sockaddr info with memset(0). Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/rose/af_rose.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index cf68e6e..9c83474 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1253,6 +1253,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
if (srose != NULL) {
+ memset(srose, 0, msg->msg_namelen);
srose->srose_family = AF_ROSE;
srose->srose_addr = rose->dest_addr;
srose->srose_call = rose->dest_call;
OpenPOWER on IntegriCloud