| From 5b919f833d9d60588d026ad82d17f17e8872c7a9 Mon Sep 17 00:00:00 2001 |
| From: Kees Cook <kees.cook@canonical.com> |
| Date: Wed, 12 Jan 2011 00:34:49 -0800 |
| Subject: net: ax25: fix information leak to userland harder |
| |
| From: Kees Cook <kees.cook@canonical.com> |
| |
| commit 5b919f833d9d60588d026ad82d17f17e8872c7a9 upstream. |
| |
| Commit fe10ae53384e48c51996941b7720ee16995cbcb7 adds a memset() to clear |
| the structure being sent back to userspace, but accidentally used the |
| wrong size. |
| |
| Reported-by: Brad Spengler <spender@grsecurity.net> |
| Signed-off-by: Kees Cook <kees.cook@canonical.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/ax25/af_ax25.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/ax25/af_ax25.c |
| +++ b/net/ax25/af_ax25.c |
| @@ -1391,7 +1391,7 @@ static int ax25_getname(struct socket *s |
| ax25_cb *ax25; |
| int err = 0; |
| |
| - memset(fsa, 0, sizeof(fsa)); |
| + memset(fsa, 0, sizeof(*fsa)); |
| lock_sock(sk); |
| ax25 = ax25_sk(sk); |
| |
