| From: Kangjie Lu <kangjielu@gmail.com> |
| Date: Tue, 3 May 2016 16:35:05 -0400 |
| Subject: net: fix infoleak in llc |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| commit b8670c09f37bdf2847cc44f36511a53afc6161fd upstream. |
| |
| The stack object “info” has a total size of 12 bytes. Its last byte |
| is padding which is not initialized and leaked via “put_cmsg”. |
| |
| Signed-off-by: Kangjie Lu <kjlu@gatech.edu> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| net/llc/af_llc.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/net/llc/af_llc.c |
| +++ b/net/llc/af_llc.c |
| @@ -626,6 +626,7 @@ static void llc_cmsg_rcv(struct msghdr * |
| if (llc->cmsg_flags & LLC_CMSG_PKTINFO) { |
| struct llc_pktinfo info; |
| |
| + memset(&info, 0, sizeof(info)); |
| info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex; |
| llc_pdu_decode_dsap(skb, &info.lpi_sap); |
| llc_pdu_decode_da(skb, info.lpi_mac); |
