Re: [patch] net_sched: stack info leak in cbq_dump_wrr()

Jiri Pirko
2013-07-29T21:20:33Z

Mon, Jul 29, 2013 at 09:36:51PM CEST, dan.carpenter@oracle.com wrote:
>opt.__reserved isn't cleared so we leak a byte of stack information.
>
>Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
>diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
>index 71a5688..6398a61 100644
>--- a/net/sched/sch_cbq.c
>+++ b/net/sched/sch_cbq.c
>@@ -1469,6 +1469,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
> opt.allot = cl->allot;
> opt.priority = cl->priority + 1;
> opt.cpriority = cl->cpriority + 1;
>+ opt.__reserved = 0;

There's probably better to zero whole opt at the beginning of the function.