appletalk: fix atalk_getname() leak

PATCH Applied Eric Dumazet 2 participants 2 messages Aug 6, 2009

Subsystems (2)

Networking Network drivers

lore

Share & tools

lore

Eric Dumazet

author

2009-08-06 12:27 UTC #0 lore raw

PATCH 1/1 appletalk: fix atalk_getname() leak

atalk_getname() can leak 8 bytes of kernel memory to user

Signed-off-by Eric Dumazet <[email protected]>

---

net/appletalk/ddp.c +1 -0

index 590b839..9ef6ff2 100644
@@ -1237,6 +1237,7 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
 			return -ENOBUFS;
 
 	*uaddr_len = sizeof(struct sockaddr_at);
+	memset(&sat.sat_zero, 0, sizeof(sat.sat_zero));
 
 	if (peer) {
 		if (sk->sk_state != TCP_ESTABLISHED)

David Miller

maintainer Applied

2009-08-06 20:17 UTC #1 lore raw

From: Eric Dumazet <[email protected]>
Date: Thu, 06 Aug 2009 14:27:43 +0200

Quoted 3 lines

atalk_getname() can leak 8 bytes of kernel memory to user
Signed-off-by Eric Dumazet <[email protected]>

Applied to net-2.6