diff options
| author | Willem de Bruijn <willemb@google.com> | 2015-01-15 13:18:40 -0500 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2015-05-09 23:16:36 +0100 |
| commit | 11235a669e34cf610cf315d8e8d3a37d1d9d9611 (patch) | |
| tree | a4bb6345eef02ad206adb7dbf6646de62f32ca9e /net/ipv6 | |
| parent | 26e0023ac5718f42e14ad41f747d3f4956c80ef5 (diff) | |
| download | kernel_samsung_smdk4412-11235a669e34cf610cf315d8e8d3a37d1d9d9611.zip kernel_samsung_smdk4412-11235a669e34cf610cf315d8e8d3a37d1d9d9611.tar.gz kernel_samsung_smdk4412-11235a669e34cf610cf315d8e8d3a37d1d9d9611.tar.bz2 | |
ip: zero sockaddr returned on error queue
[ Upstream commit f812116b174e59a350acc8e4856213a166a91222 ]
The sockaddr is returned in IP(V6)_RECVERR as part of errhdr. That
structure is defined and allocated on the stack as
struct {
struct sock_extended_err ee;
struct sockaddr_in(6) offender;
} errhdr;
The second part is only initialized for certain SO_EE_ORIGIN values.
Always initialize it completely.
An MTU exceeded error on a SOCK_RAW/IPPROTO_RAW is one example that
would return uninitialized bytes.
Signed-off-by: Willem de Bruijn <willemb@google.com>
----
Also verified that there is no padding between errhdr.ee and
errhdr.offender that could leak additional kernel data.
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/datagram.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c index 3c7c948..33719b7 100644 --- a/net/ipv6/datagram.c +++ b/net/ipv6/datagram.c @@ -371,12 +371,10 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); sin = &errhdr.offender; - sin->sin6_family = AF_UNSPEC; + memset(sin, 0, sizeof(*sin)); + if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) { sin->sin6_family = AF_INET6; - sin->sin6_flowinfo = 0; - sin->sin6_port = 0; - sin->sin6_scope_id = 0; if (skb->protocol == htons(ETH_P_IPV6)) { ipv6_addr_copy(&sin->sin6_addr, &ipv6_hdr(skb)->saddr); if (np->rxopt.all) @@ -384,11 +382,9 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL) sin->sin6_scope_id = IP6CB(skb)->iif; } else { - struct inet_sock *inet = inet_sk(sk); - ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr, &sin->sin6_addr); - if (inet->cmsg_flags) + if (inet_sk(sk)->cmsg_flags) ip_cmsg_recv(msg, skb); } } |