]> git.ipfire.org Git - thirdparty/linux.git/commit
appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak
authorYizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Fri, 29 May 2026 10:50:16 +0000 (18:50 +0800)
committerJakub Kicinski <kuba@kernel.org>
Thu, 4 Jun 2026 01:08:58 +0000 (18:08 -0700)
commit2cdeaba5a1087f0f83e56729ea5c730b498639d9
tree5033a799153cb7c5a70ff49c1e1df4a65bb90a54
parent56d0885514491e5ed8f7593400879ab77c52504c
appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak

aarp_alloc() allocates struct aarp_entry without zeroing it, but only
initializes refcnt and packet_queue.  When an unresolved AARP entry is
created, hwaddr[ETH_ALEN] is left uninitialized.

aarp_seq_show() later prints this field with %pM when users read
/proc/net/atalk/arp.  This can expose 6 bytes of stale heap data for
each unresolved entry.

Fix this by zero-initializing struct aarp_entry at allocation time.

Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260529105017.81531-1-zhaoyz24@mails.tsinghua.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/appletalk/aarp.c