summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMathias Krause <minipli@googlemail.com>2013-04-07 01:51:59 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-05-01 09:41:05 -0700
commit1a4dc01afc19f4a30c015ef62a43930241ee15b1 (patch)
tree924086b5c572dac58ef0ac8879e1ea820c196676
parent1091d7dddb9f0fc287bf17c5f6c7859fe0bc50b3 (diff)
downloadlinux-stable-1a4dc01afc19f4a30c015ef62a43930241ee15b1.tar.gz
rose: fix info leak via msg_name in rose_recvmsg()
[ Upstream commit 4a184233f21645cf0b719366210ed445d1024d72 ] The code in rose_recvmsg() does not initialize all of the members of struct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info. Nor does it initialize the padding bytes of the structure inserted by the compiler for alignment. This will lead to leaking uninitialized kernel stack bytes in net/socket.c. Fix the issue by initializing the memory used for sockaddr info with memset(0). Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--net/rose/af_rose.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index c4719ce604c2..7f645d115795 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1257,6 +1257,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
if (srose != NULL) {
+ memset(srose, 0, msg->msg_namelen);
srose->srose_family = AF_ROSE;
srose->srose_addr = rose->dest_addr;
srose->srose_call = rose->dest_call;