can: Fix raw_getname() leak

PATCH Applied Eric Dumazet 3 participants 3 messages Aug 7, 2009 – Aug 10, 2009

Subsystems (3)

Networking Network drivers CAN network layer

lore

Share & tools

lore

Eric Dumazet

author

2009-08-07 06:27 UTC #0 lore raw

PATCH 1/1 can: Fix raw_getname() leak

raw_getname() can leak 10 bytes of kernel memory to user

(two bytes hole between can_family and can_ifindex, 8 bytes at the end of sockaddr_can structure)

Signed-off-by Eric Dumazet <[email protected]>

---

net/can/raw.c +1 -0

index f4cc445..db3152d 100644
@@ -401,6 +401,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
 	if (peer)
 		return -EOPNOTSUPP;
 
+	memset(addr, 0, sizeof(*addr));
 	addr->can_family  = AF_CAN;
 	addr->can_ifindex = ro->ifindex;

Oliver Hartkopp

Acked-by on v1 1/1

2009-08-07 06:32 UTC #1 lore raw

Quoted 6 lines · Eric Dumazet

raw_getname() can leak 10 bytes of kernel memory to user
(two bytes hole between can_family and can_ifindex, 8 bytes at the end of sockaddr_can structure)
Signed-off-by Eric Dumazet <[email protected]>

Acked-by Oliver Hartkopp <[email protected]>

Thanks Eric!

Quoted 13 lines

---

net/can/raw.c +1 -0

index f4cc445..db3152d 100644
@@ -401,6 +401,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
 	if (peer)
 		return -EOPNOTSUPP;
 
+	memset(addr, 0, sizeof(*addr));
 	addr->can_family  = AF_CAN;
 	addr->can_ifindex = ro->ifindex;

David Miller

maintainer Applied

2009-08-10 04:52 UTC #2 lore raw

From: Oliver Hartkopp <[email protected]>
Date: Fri, 07 Aug 2009 08:31:59 +0200

Quoted 9 lines

Quoted 6 lines · Eric Dumazet
raw_getname() can leak 10 bytes of kernel memory to user
(two bytes hole between can_family and can_ifindex, 8 bytes at the end of sockaddr_can structure)
Signed-off-by Eric Dumazet <[email protected]>
Acked-by Oliver Hartkopp <[email protected]>

Applied.