summaryrefslogtreecommitdiffstats
path: root/lib
diff options
context:
space:
mode:
authorJiri Benc <jbenc@redhat.com>2015-03-29 16:05:28 +0200
committerDavid S. Miller <davem@davemloft.net>2015-03-31 14:07:24 -0400
commit5899f0478528b59ea9ced201eacb3e56ca406c39 (patch)
treeb260bb0d9c9089954268ba60a625f0d995334060 /lib
parentf5e2dc5d7fe78fe4d8748d217338f4f7b6a5d7ea (diff)
downloadop-kernel-dev-5899f0478528b59ea9ced201eacb3e56ca406c39.zip
op-kernel-dev-5899f0478528b59ea9ced201eacb3e56ca406c39.tar.gz
netlink: pad nla_memcpy dest buffer with zeroes
This is especially important in cases where the kernel allocs a new structure and expects a field to be set from a netlink attribute. If such attribute is shorter than expected, the rest of the field is left containing previous data. When such field is read back by the user space, kernel memory content is leaked. Signed-off-by: Jiri Benc <jbenc@redhat.com> Acked-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'lib')
-rw-r--r--lib/nlattr.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/nlattr.c b/lib/nlattr.c
index 76a1b59..f5907d2 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -279,6 +279,8 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count)
int minlen = min_t(int, count, nla_len(src));
memcpy(dest, nla_data(src), minlen);
+ if (count > minlen)
+ memset(dest + minlen, 0, count - minlen);
return minlen;
}
OpenPOWER on IntegriCloud