aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorMathias Krause2013-04-06 20:51:54 -0500
committerGreg Kroah-Hartman2013-05-01 11:46:02 -0500
commit9d22aa4b113691ce0ed033d52997a25530e3f3d0 (patch)
tree9e5be604ba61f9aefd41847f367f0a010f452191 /net
parentc4c63badde92f235a837589aa475e27014791c9e (diff)
downloadkernel-video-9d22aa4b113691ce0ed033d52997a25530e3f3d0.tar.gz
kernel-video-9d22aa4b113691ce0ed033d52997a25530e3f3d0.tar.xz
kernel-video-9d22aa4b113691ce0ed033d52997a25530e3f3d0.zip
iucv: Fix missing msg_namelen update in iucv_sock_recvmsg()
[ Upstream commit a5598bd9c087dc0efc250a5221e5d0e6f584ee88 ] The current code does not fill the msg_name member in case it is set. It also does not set the msg_namelen member to 0 and therefore makes net/socket.c leak the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. Fix that by simply setting msg_namelen to 0 as obviously nobody cared about iucv_sock_recvmsg() not filling the msg_name in case it was set. Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/iucv/af_iucv.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index cd6f7a991d8..625bc50391c 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1331,6 +1331,8 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
1331 struct sk_buff *skb, *rskb, *cskb; 1331 struct sk_buff *skb, *rskb, *cskb;
1332 int err = 0; 1332 int err = 0;
1333 1333
1334 msg->msg_namelen = 0;
1335
1334 if ((sk->sk_state == IUCV_DISCONN) && 1336 if ((sk->sk_state == IUCV_DISCONN) &&
1335 skb_queue_empty(&iucv->backlog_skb_q) && 1337 skb_queue_empty(&iucv->backlog_skb_q) &&
1336 skb_queue_empty(&sk->sk_receive_queue) && 1338 skb_queue_empty(&sk->sk_receive_queue) &&