* [PATCH net-2.6] can: Fix raw_getname() leak
@ 2009-08-07 6:27 Eric Dumazet
2009-08-07 6:31 ` Oliver Hartkopp
0 siblings, 1 reply; 3+ messages in thread
From: Eric Dumazet @ 2009-08-07 6:27 UTC (permalink / raw)
To: David S. Miller; +Cc: Linux Netdev List, Oliver Hartkopp
raw_getname() can leak 10 bytes of kernel memory to user
(two bytes hole between can_family and can_ifindex,
8 bytes at the end of sockaddr_can structure)
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---
diff --git a/net/can/raw.c b/net/can/raw.c
index f4cc445..db3152d 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -401,6 +401,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
if (peer)
return -EOPNOTSUPP;
+ memset(addr, 0, sizeof(*addr));
addr->can_family = AF_CAN;
addr->can_ifindex = ro->ifindex;
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net-2.6] can: Fix raw_getname() leak
2009-08-07 6:27 [PATCH net-2.6] can: Fix raw_getname() leak Eric Dumazet
@ 2009-08-07 6:31 ` Oliver Hartkopp
2009-08-10 4:52 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Oliver Hartkopp @ 2009-08-07 6:31 UTC (permalink / raw)
To: Eric Dumazet; +Cc: David S. Miller, Linux Netdev List
Eric Dumazet wrote:
> raw_getname() can leak 10 bytes of kernel memory to user
>
> (two bytes hole between can_family and can_ifindex,
> 8 bytes at the end of sockaddr_can structure)
>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Oliver Hartkopp <oliver@hartkopp.net>
Thanks Eric!
> ---
> diff --git a/net/can/raw.c b/net/can/raw.c
> index f4cc445..db3152d 100644
> --- a/net/can/raw.c
> +++ b/net/can/raw.c
> @@ -401,6 +401,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
> if (peer)
> return -EOPNOTSUPP;
>
> + memset(addr, 0, sizeof(*addr));
> addr->can_family = AF_CAN;
> addr->can_ifindex = ro->ifindex;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net-2.6] can: Fix raw_getname() leak
2009-08-07 6:31 ` Oliver Hartkopp
@ 2009-08-10 4:52 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2009-08-10 4:52 UTC (permalink / raw)
To: oliver; +Cc: eric.dumazet, netdev
From: Oliver Hartkopp <oliver@hartkopp.net>
Date: Fri, 07 Aug 2009 08:31:59 +0200
> Eric Dumazet wrote:
>> raw_getname() can leak 10 bytes of kernel memory to user
>>
>> (two bytes hole between can_family and can_ifindex,
>> 8 bytes at the end of sockaddr_can structure)
>>
>> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
>
> Acked-by: Oliver Hartkopp <oliver@hartkopp.net>
Applied.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2009-08-10 4:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-08-07 6:27 [PATCH net-2.6] can: Fix raw_getname() leak Eric Dumazet
2009-08-07 6:31 ` Oliver Hartkopp
2009-08-10 4:52 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).