]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
rose: fix info leak via msg_name in rose_recvmsg()
authorMathias Krause <minipli@googlemail.com>
Sun, 7 Apr 2013 01:51:59 +0000 (01:51 +0000)
committerPaul Gortmaker <paul.gortmaker@windriver.com>
Mon, 10 Feb 2014 21:10:47 +0000 (16:10 -0500)
commit937eabb356279bd9d74de453f0052ba92f5733c5
tree7fa5a0c687a1f00612c633cfc4a371a34ec4d5d4
parent9c3c9ff3e60d351dfcd0e291eb7391fe9d3332a3
rose: fix info leak via msg_name in rose_recvmsg()

commit 4a184233f21645cf0b719366210ed445d1024d72 upstream.

The code in rose_recvmsg() does not initialize all of the members of
struct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info.
Nor does it initialize the padding bytes of the structure inserted by
the compiler for alignment. This will lead to leaking uninitialized
kernel stack bytes in net/socket.c.

Fix the issue by initializing the memory used for sockaddr info with
memset(0).

Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
net/rose/af_rose.c