| Message ID | 1380571540-15532-1-git-send-email-minipli@googlemail.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Mathias Krause <minipli@googlemail.com> Date: Mon, 30 Sep 2013 22:05:40 +0200 > When filling the netlink message we miss to wipe the pad field, > therefore leak one byte of heap memory to userland. Fix this by > setting pad to 0. > > Signed-off-by: Mathias Krause <minipli@googlemail.com> Applied and queued up for -stable, thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/unix/diag.c b/net/unix/diag.c index d591091..86fa0f3 100644 --- a/net/unix/diag.c +++ b/net/unix/diag.c @@ -124,6 +124,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r rep->udiag_family = AF_UNIX; rep->udiag_type = sk->sk_type; rep->udiag_state = sk->sk_state; + rep->pad = 0; rep->udiag_ino = sk_ino; sock_diag_save_cookie(sk, rep->udiag_cookie);
When filling the netlink message we miss to wipe the pad field, therefore leak one byte of heap memory to userland. Fix this by setting pad to 0. Signed-off-by: Mathias Krause <minipli@googlemail.com> --- Probably material for stable as well (v3.3+). net/unix/diag.c | 1 + 1 file changed, 1 insertion(+)