Patchwork [3.5.y.z,extended,stable] Patch "tipc: fix info leaks via msg_name in recv_msg/recv_stream" has been added to staging queue

mail settings
Submitter Luis Henriques
Date May 1, 2013, 11:34 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/240850/
State New
Headers show


Luis Henriques - May 1, 2013, 11:34 p.m.
This is a note to let you know that I have just added a patch titled

    tipc: fix info leaks via msg_name in recv_msg/recv_stream

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 6997f8d5eb90744e960ee5684de2cd75eeceeba4 Mon Sep 17 00:00:00 2001
From: Mathias Krause <>
Date: Sun, 7 Apr 2013 01:52:00 +0000
Subject: [PATCH] tipc: fix info leaks via msg_name in recv_msg/recv_stream

commit 60085c3d009b0df252547adb336d1ccca5ce52ec upstream.

The code in set_orig_addr() does not initialize all of the members of
struct sockaddr_tipc when filling the sockaddr info -- namely the union
is only partly filled. This will make recv_msg() and recv_stream() --
the only users of this function -- leak kernel stack memory as the
msg_name member is a local variable in net/socket.c.

Additionally to that both recv_msg() and recv_stream() fail to update
the msg_namelen member to 0 while otherwise returning with 0, i.e.
"success". This is the case for, e.g., non-blocking sockets. This will
lead to a 128 byte kernel stack leak in net/socket.c.

Fix the first issue by initializing the memory of the union with
memset(0). Fix the second one by setting msg_namelen to 0 early as it
will be updated later if we're going to fill the msg_name member.

Cc: Jon Maloy <>
Cc: Allan Stephens <>
Signed-off-by: Mathias Krause <>
Signed-off-by: David S. Miller <>
Signed-off-by: Luis Henriques <>
 net/tipc/socket.c | 7 +++++++
 1 file changed, 7 insertions(+)



diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 5577a44..91fd130 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -802,6 +802,7 @@  static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
 	if (addr) {
 		addr->family = AF_TIPC;
 		addr->addrtype = TIPC_ADDR_ID;
+		memset(&addr->addr, 0, sizeof(addr->addr));
 		addr-> = msg_origport(msg);
 		addr-> = msg_orignode(msg);
 		addr-> = 0;	/* could leave uninitialized */
@@ -916,6 +917,9 @@  static int recv_msg(struct kiocb *iocb, struct socket *sock,
 		goto exit;

+	/* will be updated in set_orig_addr() if needed */
+	m->msg_namelen = 0;
 	timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);

@@ -1032,6 +1036,9 @@  static int recv_stream(struct kiocb *iocb, struct socket *sock,
 		goto exit;

+	/* will be updated in set_orig_addr() if needed */
+	m->msg_namelen = 0;
 	target = sock_rcvlowat(sk, flags & MSG_WAITALL, buf_len);
 	timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);