Skip to content

Commit

Permalink
rose: fix info leak via msg_name in rose_recvmsg()
Browse files Browse the repository at this point in the history
The code in rose_recvmsg() does not initialize all of the members of
struct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info.
Nor does it initialize the padding bytes of the structure inserted by
the compiler for alignment. This will lead to leaking uninitialized
kernel stack bytes in net/socket.c.

Fix the issue by initializing the memory used for sockaddr info with
memset(0).

Cc: Ralf Baechle <[email protected]>
Signed-off-by: Mathias Krause <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
  • Loading branch information
minipli authored and davem330 committed Apr 7, 2013
1 parent d26d650 commit 4a18423
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions net/rose/af_rose.c
Original file line number Diff line number Diff line change
Expand Up @@ -1253,6 +1253,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);

if (srose != NULL) {
memset(srose, 0, msg->msg_namelen);
srose->srose_family = AF_ROSE;
srose->srose_addr = rose->dest_addr;
srose->srose_call = rose->dest_call;
Expand Down

0 comments on commit 4a18423

Please sign in to comment.