| From 254a1a8c57de78903eeeb673a2f133970d2bc942 Mon Sep 17 00:00:00 2001 |
| From: Mathias Krause <minipli@googlemail.com> |
| Date: Sun, 7 Apr 2013 01:51:56 +0000 |
| Subject: [PATCH] llc: Fix missing msg_namelen update in llc_ui_recvmsg() |
| |
| commit c77a4b9cffb6215a15196ec499490d116dfad181 upstream. |
| |
| For stream sockets the code misses to update the msg_namelen member |
| to 0 and therefore makes net/socket.c leak the local, uninitialized |
| sockaddr_storage variable to userland -- 128 bytes of kernel stack |
| memory. The msg_namelen update is also missing for datagram sockets |
| in case the socket is shutting down during receive. |
| |
| Fix both issues by setting msg_namelen to 0 early. It will be |
| updated later if we're going to fill the msg_name member. |
| |
| Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> |
| Signed-off-by: Mathias Krause <minipli@googlemail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| --- |
| net/llc/af_llc.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c |
| index 06010e1e89f9..121c92e3c128 100644 |
| --- a/net/llc/af_llc.c |
| +++ b/net/llc/af_llc.c |
| @@ -719,6 +719,8 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock, |
| int target; /* Read at least this many bytes */ |
| long timeo; |
| |
| + msg->msg_namelen = 0; |
| + |
| lock_sock(sk); |
| copied = -ENOTCONN; |
| if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN)) |
| -- |
| 1.8.5.2 |
| |
