]> git.ipfire.org Git - people/ms/linux.git/commit
rose: fix info leak via msg_name in rose_recvmsg()
authorMathias Krause <minipli@googlemail.com>
Sun, 7 Apr 2013 01:51:59 +0000 (01:51 +0000)
committerBen Hutchings <ben@decadent.org.uk>
Mon, 13 May 2013 14:02:41 +0000 (15:02 +0100)
commitf05503a9ef115c505b36fcd75f77b341811e9169
treea7410f7a91e3a0fd1714bc3f01846fad237c30b1
parentc0bf432a4c3e6870fc87debb9393cb93f638dcba
rose: fix info leak via msg_name in rose_recvmsg()

[ Upstream commit 4a184233f21645cf0b719366210ed445d1024d72 ]

The code in rose_recvmsg() does not initialize all of the members of
struct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info.
Nor does it initialize the padding bytes of the structure inserted by
the compiler for alignment. This will lead to leaking uninitialized
kernel stack bytes in net/socket.c.

Fix the issue by initializing the memory used for sockaddr info with
memset(0).

Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
net/rose/af_rose.c