| From c108d07365ddd2fec6b17fb40e00731b7db06bda Mon Sep 17 00:00:00 2001 |
| From: Mathias Krause <minipli@googlemail.com> |
| Date: Sun, 7 Apr 2013 01:51:56 +0000 |
| Subject: llc: Fix missing msg_namelen update in llc_ui_recvmsg() |
| |
| |
| From: Mathias Krause <minipli@googlemail.com> |
| |
| [ Upstream commit c77a4b9cffb6215a15196ec499490d116dfad181 ] |
| |
| For stream sockets the code misses to update the msg_namelen member |
| to 0 and therefore makes net/socket.c leak the local, uninitialized |
| sockaddr_storage variable to userland -- 128 bytes of kernel stack |
| memory. The msg_namelen update is also missing for datagram sockets |
| in case the socket is shutting down during receive. |
| |
| Fix both issues by setting msg_namelen to 0 early. It will be |
| updated later if we're going to fill the msg_name member. |
| |
| Signed-off-by: Mathias Krause <minipli@googlemail.com> |
| Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/llc/af_llc.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/net/llc/af_llc.c |
| +++ b/net/llc/af_llc.c |
| @@ -721,6 +721,8 @@ static int llc_ui_recvmsg(struct kiocb * |
| int target; /* Read at least this many bytes */ |
| long timeo; |
| |
| + msg->msg_namelen = 0; |
| + |
| lock_sock(sk); |
| copied = -ENOTCONN; |
| if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN)) |
