aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMathias Krause <minipli@googlemail.com>2012-08-15 11:31:57 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-10-02 09:47:22 -0700
commit7a62b446c607d994f82a578bbca5995a0aa0183d (patch)
tree62fad98f506c174534f06835f1695c8d58c38f7e
parentb56518548aa6e99e80c6c67b5a7d7f2c8c614c74 (diff)
downloadkernel_samsung_smdk4412-7a62b446c607d994f82a578bbca5995a0aa0183d.zip
kernel_samsung_smdk4412-7a62b446c607d994f82a578bbca5995a0aa0183d.tar.gz
kernel_samsung_smdk4412-7a62b446c607d994f82a578bbca5995a0aa0183d.tar.bz2
net: fix info leak in compat dev_ifconf()
[ Upstream commit 43da5f2e0d0c69ded3d51907d9552310a6b545e8 ] The implementation of dev_ifconf() for the compat ioctl interface uses an intermediate ifc structure allocated in userland for the duration of the syscall. Though, it fails to initialize the padding bytes inserted for alignment and that for leaks four bytes of kernel stack. Add an explicit memset(0) before filling the structure to avoid the info leak. Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--net/socket.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/socket.c b/net/socket.c
index cf41afc..1b0f0fc 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2645,6 +2645,7 @@ static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
return -EFAULT;
+ memset(&ifc, 0, sizeof(ifc));
if (ifc32.ifcbuf == 0) {
ifc32.ifc_len = 0;
ifc.ifc_len = 0;