Skip to contentSkip to conversation

qlcnic: info leak in qlcnic_dcb_peer_app_info()

PATCH Applied Dan Carpenter 3 participants 3 messages May 23, 2014 – May 26, 2014

Subsystems (4)
Networking Network drivers Kernel janitors QLogic qlcnic (1/10)Gb Ethernet driver
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 qlcnic: info leak in qlcnic_dcb_peer_app_info()

This function is called from dcbnl_build_peer_app(). The "info" struct isn't initialized at all so we disclose 2 bytes of uninitialized stack data. We should clear it before passing it to the user.

Fixes 48365e485275 ('qlcnic: dcb: Add support for CEE Netlink interface.')
Signed-off-by Dan Carpenter <[email protected]>

---
This is a static analysis patch, and I am not familiar with this code. We may want to put some useful information here, to go with the app_count.

drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c +1 -0
index a51fe18..561cb11 100644
@@ -1020,6 +1020,7 @@ static int qlcnic_dcb_peer_app_info(struct net_device *netdev,
 	struct qlcnic_dcb_cee *peer;
 	int i;
 
+	memset(info, 0, sizeof(*info));
 	*app_count = 0;
 
 	if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
maintainer Applied
#1 lore raw

From: Dan Carpenter <[email protected]>
Date: Fri, 23 May 2014 19:37:21 +0300

Quoted 10 lines

This function is called from dcbnl_build_peer_app(). The "info" struct isn't initialized at all so we disclose 2 bytes of uninitialized stack data. We should clear it before passing it to the user.

Fixes 48365e485275 ('qlcnic: dcb: Add support for CEE Netlink interface.')
Signed-off-by Dan Carpenter <[email protected]>

---
This is a static analysis patch, and I am not familiar with this code. We may want to put some useful information here, to go with the app_count.

I've applied this and queued it up for -stable, thanks Dan.

Acked-by on v1 1/1
#2 lore raw
In reply to Dan Carpenter
Quoted 7 lines

-----Original Message-----
From: Dan Carpenter [mailto:[email protected]]
Sent: Friday, May 23, 2014 10:07 PM
To: Shahed Shaikh; Sucheta Chakraborty
Cc: Dept-HSG Linux NIC Dev; netdev; [email protected]
Subject: [patch] qlcnic: info leak in qlcnic_dcb_peer_app_info()

Quoted 7 lines

This function is called from dcbnl_build_peer_app(). The "info" struct isn't initialized at all so we disclose 2 bytes of uninitialized stack data. We should clear it before passing it to the user.

Fixes 48365e485275 ('qlcnic: dcb: Add support for CEE Netlink

interface.')

Signed-off-by Dan Carpenter <[email protected]>
Acked-by Sucheta Chakraborty <[email protected]>

Thanks,
Sucheta.

Quoted 19 lines

---
This is a static analysis patch, and I am not familiar with this code. We may want to put some useful information here, to go with the app_count.

drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c +1 -0
index a51fe18..561cb11 100644
@@ -1020,6 +1020,7 @@ static int qlcnic_dcb_peer_app_info(struct
 net_device *netdev,
 	struct qlcnic_dcb_cee *peer;
 	int i;
 
+	memset(info, 0, sizeof(*info));
 	*app_count = 0;

if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))