xfrm: clear trailing padding in build_polexpire()

commit 71a98248c63c535eaa4d4c22f099b68d902006d0 upstream.

build_expire() clears the trailing padding bytes of struct
xfrm_user_expire after setting the hard field via memset_after(),
but the analogous function build_polexpire() does not do this for
struct xfrm_user_polexpire.

The padding bytes after the __u8 hard field are left
uninitialized from the heap allocation, and are then sent to
userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
leaking kernel heap memory contents.

Add the missing memset_after() call, matching build_expire().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d70640a0f27ffdbaf949c5b07227a5055dba17c5..64137facd128e5adc0ee600d69dc41e5a8c22fd6 100644 (file)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -3524,6 +3524,8 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
                return err;
        }
        upe->hard = !!hard;
+       /* clear the padding bytes */
+       memset_after(upe, 0, hard);
 
        nlmsg_end(skb, nlh);
        return 0;