blob: cbc6b7f9f04205ce7872ee7ed8851286d26b35ea [file] [log] [blame]
From fa8342f055d6251e4ea205d8f3bc01e7e646b8d7 Mon Sep 17 00:00:00 2001
From: Sargun Dhillon <>
Date: Mon, 30 Dec 2019 12:35:03 -0800
Subject: [PATCH] samples/seccomp: Zero out members based on
commit 771b894f2f3dfedc2ba5561731fffa0e39b1bbb6 upstream.
The sizes by which seccomp_notif and seccomp_notif_resp are allocated are
based on the SECCOMP_GET_NOTIF_SIZES ioctl. This allows for graceful
extension of these datastructures. If userspace zeroes out the
datastructure based on its version, and it is lagging behind the kernel's
version, it will end up sending trailing garbage. On the other hand,
if it is ahead of the kernel version, it will write extra zero space,
and potentially cause corruption.
Signed-off-by: Sargun Dhillon <>
Suggested-by: Tycho Andersen <>
Fixes: fec7b6690541 ("samples: add an example of seccomp user trap")
Signed-off-by: Kees Cook <>
Signed-off-by: Paul Gortmaker <>
diff --git a/samples/seccomp/user-trap.c b/samples/seccomp/user-trap.c
index 6d0125ca8af7..20291ec6489f 100644
--- a/samples/seccomp/user-trap.c
+++ b/samples/seccomp/user-trap.c
@@ -298,14 +298,14 @@ int main(void)
req = malloc(sizes.seccomp_notif);
if (!req)
goto out_close;
- memset(req, 0, sizeof(*req));
resp = malloc(sizes.seccomp_notif_resp);
if (!resp)
goto out_req;
- memset(resp, 0, sizeof(*resp));
+ memset(resp, 0, sizes.seccomp_notif_resp);
while (1) {
+ memset(req, 0, sizes.seccomp_notif);
if (ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, req)) {
perror("ioctl recv");
goto out_resp;