From patchwork Wed May 1 23:34:17 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luis Henriques X-Patchwork-Id: 240842 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 600772C00D0 for ; Thu, 2 May 2013 09:34:39 +1000 (EST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1UXgXh-0000Ax-Ap; Wed, 01 May 2013 23:34:33 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1UXgXX-00006e-9t for kernel-team@lists.ubuntu.com; Wed, 01 May 2013 23:34:23 +0000 Received: from [206.15.84.130] (helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1UXgXV-0002wE-E5; Wed, 01 May 2013 23:34:22 +0000 From: Luis Henriques To: Mathias Krause Subject: [ 3.5.y.z extended stable ] Patch "NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg()" has been added to staging queue Date: Thu, 2 May 2013 00:34:17 +0100 Message-Id: <1367451257-19809-1-git-send-email-luis.henriques@canonical.com> X-Mailer: git-send-email 1.8.1.2 X-Extended-Stable: 3.5 Cc: Samuel Ortiz , Lauro Ramos Venancio , kernel-team@lists.ubuntu.com, "David S. Miller" , Aloisio Almeida Jr X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com This is a note to let you know that I have just added a patch titled NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg() to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree which can be found at: http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.5.y-queue If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.5.y.z tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Luis ------ From 636b5080d1e78130cd1787cc3e2e0908239f6636 Mon Sep 17 00:00:00 2001 From: Mathias Krause Date: Sun, 7 Apr 2013 01:51:58 +0000 Subject: [PATCH] NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg() commit d26d6504f23e803824e8ebd14e52d4fc0a0b09cb upstream. The code in llcp_sock_recvmsg() does not initialize all the members of struct sockaddr_nfc_llcp when filling the sockaddr info. Nor does it initialize the padding bytes of the structure inserted by the compiler for alignment. Also, if the socket is in state LLCP_CLOSED or is shutting down during receive the msg_namelen member is not updated to 0 while otherwise returning with 0, i.e. "success". The msg_namelen update is also missing for stream and seqpacket sockets which don't fill the sockaddr info. Both issues lead to the fact that the code will leak uninitialized kernel stack bytes in net/socket.c. Fix the first issue by initializing the memory used for sockaddr info with memset(0). Fix the second one by setting msg_namelen to 0 early. It will be updated later if we're going to fill the msg_name member. Cc: Lauro Ramos Venancio Cc: Aloisio Almeida Jr Cc: Samuel Ortiz Signed-off-by: Mathias Krause Signed-off-by: David S. Miller [ luis: 3.5 is not affected by first issue. ] Signed-off-by: Luis Henriques --- net/nfc/llcp/sock.c | 2 ++ 1 file changed, 2 insertions(+) -- 1.8.1.2 diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c index e06d458..80200ac 100644 --- a/net/nfc/llcp/sock.c +++ b/net/nfc/llcp/sock.c @@ -570,6 +570,8 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock, pr_debug("%p %zu\n", sk, len); + msg->msg_namelen = 0; + lock_sock(sk); if (sk->sk_state == LLCP_CLOSED &&