diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2009-08-06 20:27:04 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-09-08 20:34:07 -0700 |
| commit | 3020cf2a8341ebe53d689826fb569f309286e654 (patch) | |
| tree | 3fd66c6bbbe5e1820fe1db123f99e037f446aba5 | |
| parent | 27a473ee7017dabac9073d0c57db72bd680409a8 (diff) | |
| download | linux-stable-3020cf2a8341ebe53d689826fb569f309286e654.tar.gz linux-stable-3020cf2a8341ebe53d689826fb569f309286e654.tar.bz2 linux-stable-3020cf2a8341ebe53d689826fb569f309286e654.zip | |
can: Fix raw_getname() leak
commit e84b90ae5eb3c112d1f208964df1d8156a538289 upstream.
raw_getname() can leak 10 bytes of kernel memory to user
(two bytes hole between can_family and can_ifindex,
8 bytes at the end of sockaddr_can structure)
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Oliver Hartkopp <oliver@hartkopp.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | net/can/raw.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/can/raw.c b/net/can/raw.c index 6aa154e806ae..5df3bf60d692 100644 --- a/net/can/raw.c +++ b/net/can/raw.c @@ -397,6 +397,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr, if (peer) return -EOPNOTSUPP; + memset(addr, 0, sizeof(*addr)); addr->can_family = AF_CAN; addr->can_ifindex = ro->ifindex; |