summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorMathias Krause <minipli@googlemail.com>2012-08-15 11:31:57 +0000
committerDavid S. Miller <davem@davemloft.net>2012-08-15 21:36:31 -0700
commit43da5f2e0d0c69ded3d51907d9552310a6b545e8 (patch)
treea4858b0f6b300c06e12986b7c29e7a4d9ece76d9 /net
parent2d8a041b7bfe1097af21441cb77d6af95f4f4680 (diff)
downloadlinux-stable-43da5f2e0d0c69ded3d51907d9552310a6b545e8.tar.gz
linux-stable-43da5f2e0d0c69ded3d51907d9552310a6b545e8.tar.bz2
linux-stable-43da5f2e0d0c69ded3d51907d9552310a6b545e8.zip
net: fix info leak in compat dev_ifconf()
The implementation of dev_ifconf() for the compat ioctl interface uses an intermediate ifc structure allocated in userland for the duration of the syscall. Though, it fails to initialize the padding bytes inserted for alignment and that for leaks four bytes of kernel stack. Add an explicit memset(0) before filling the structure to avoid the info leak. Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/socket.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/socket.c b/net/socket.c
index dfe5b66c97e0..a5471f804d99 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2657,6 +2657,7 @@ static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
return -EFAULT;
+ memset(&ifc, 0, sizeof(ifc));
if (ifc32.ifcbuf == 0) {
ifc32.ifc_len = 0;
ifc.ifc_len = 0;