From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mathias Krause Subject: [PATCH 03/16] Bluetooth: fix possible info leak in bt_sock_recvmsg() Date: Sun, 7 Apr 2013 13:51:49 +0200 Message-ID: <1365335522-29931-4-git-send-email-minipli@googlemail.com> References: <1365335522-29931-1-git-send-email-minipli@googlemail.com> Cc: netdev@vger.kernel.org, Allan Stephens , Aloisio Almeida Jr , Andy King , Arnaldo Carvalho de Melo , Dmitry Torokhov , George Zhang , Gustavo Padovan , Johan Hedberg , Jon Maloy , Lauro Ramos Venancio , Marcel Holtmann , Ralf Baechle , Samuel Ortiz , Samuel Ortiz , Sjur Braendeland , Ursula Braun , Brad Spengler , Mathias Krause To: "David S. Miller" Return-path: Received: from mail-bk0-f52.google.com ([209.85.214.52]:43011 "EHLO mail-bk0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933443Ab3DGLw1 (ORCPT ); Sun, 7 Apr 2013 07:52:27 -0400 Received: by mail-bk0-f52.google.com with SMTP id it16so2618672bkc.25 for ; Sun, 07 Apr 2013 04:52:26 -0700 (PDT) In-Reply-To: <1365335522-29931-1-git-send-email-minipli@googlemail.com> Sender: netdev-owner@vger.kernel.org List-ID: In case the socket is already shutting down, bt_sock_recvmsg() returns with 0 without updating msg_namelen leading to net/socket.c leaking the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. Fix this by moving the msg_namelen assignment in front of the shutdown test. Cc: Marcel Holtmann Cc: Gustavo Padovan Cc: Johan Hedberg Signed-off-by: Mathias Krause --- net/bluetooth/af_bluetooth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index d3ee69b..0d1b08c 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -230,6 +230,8 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock, if (flags & (MSG_OOB)) return -EOPNOTSUPP; + msg->msg_namelen = 0; + skb = skb_recv_datagram(sk, flags, noblock, &err); if (!skb) { if (sk->sk_shutdown & RCV_SHUTDOWN) @@ -237,8 +239,6 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock, return err; } - msg->msg_namelen = 0; - copied = skb->len; if (len < copied) { msg->msg_flags |= MSG_TRUNC; -- 1.7.10.4