aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorMathias Krause2013-04-06 20:51:59 -0500
committerGreg Kroah-Hartman2013-05-01 11:46:15 -0500
commit187c7184e34781b34ae5b9cb54a0866022ce1415 (patch)
tree0ac8ad5cda4ab084af5c28602803daa9d719afcb /net
parent0e8e0a9e59a7a1aec4e5490e632a412a69fbed37 (diff)
downloadkernel-video-187c7184e34781b34ae5b9cb54a0866022ce1415.tar.gz
kernel-video-187c7184e34781b34ae5b9cb54a0866022ce1415.tar.xz
kernel-video-187c7184e34781b34ae5b9cb54a0866022ce1415.zip
rose: fix info leak via msg_name in rose_recvmsg()
[ Upstream commit 4a184233f21645cf0b719366210ed445d1024d72 ] The code in rose_recvmsg() does not initialize all of the members of struct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info. Nor does it initialize the padding bytes of the structure inserted by the compiler for alignment. This will lead to leaking uninitialized kernel stack bytes in net/socket.c. Fix the issue by initializing the memory used for sockaddr info with memset(0). Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/rose/af_rose.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index c4719ce604c..7f645d11579 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1257,6 +1257,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
1257 skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 1257 skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1258 1258
1259 if (srose != NULL) { 1259 if (srose != NULL) {
1260 memset(srose, 0, msg->msg_namelen);
1260 srose->srose_family = AF_ROSE; 1261 srose->srose_family = AF_ROSE;
1261 srose->srose_addr = rose->dest_addr; 1262 srose->srose_addr = rose->dest_addr;
1262 srose->srose_call = rose->dest_call; 1263 srose->srose_call = rose->dest_call;