summaryrefslogtreecommitdiffstats
path: root/net/llc
diff options
context:
space:
mode:
authorKangjie Lu <kangjielu@gmail.com>2016-05-03 16:35:05 -0400
committerDavid S. Miller <davem@davemloft.net>2016-05-04 16:18:48 -0400
commitb8670c09f37bdf2847cc44f36511a53afc6161fd (patch)
tree30c2e57ee6f84f58c04ca3e3c440a0ec2a3dd9c1 /net/llc
parent1c021bb717a70aaeaa4b25c91f43c2aeddd922de (diff)
downloadlinux-stable-b8670c09f37bdf2847cc44f36511a53afc6161fd.tar.gz
linux-stable-b8670c09f37bdf2847cc44f36511a53afc6161fd.tar.bz2
linux-stable-b8670c09f37bdf2847cc44f36511a53afc6161fd.zip
net: fix infoleak in llc
The stack object “info” has a total size of 12 bytes. Its last byte is padding which is not initialized and leaked via “put_cmsg”. Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/llc')
-rw-r--r--net/llc/af_llc.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index b3c52e3f689a..8ae3ed97d95c 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -626,6 +626,7 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
if (llc->cmsg_flags & LLC_CMSG_PKTINFO) {
struct llc_pktinfo info;
+ memset(&info, 0, sizeof(info));
info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex;
llc_pdu_decode_dsap(skb, &info.lpi_sap);
llc_pdu_decode_da(skb, info.lpi_mac);