Patchwork [net] unix_diag: fix info leak

login
register
mail settings
Submitter Mathias Krause
Date Sept. 30, 2013, 8:05 p.m.
Message ID <1380571540-15532-1-git-send-email-minipli@googlemail.com>
Download mbox | patch
Permalink /patch/279249/
State Accepted
Delegated to: David Miller
Headers show

Comments

Mathias Krause - Sept. 30, 2013, 8:05 p.m.
When filling the netlink message we miss to wipe the pad field,
therefore leak one byte of heap memory to userland. Fix this by
setting pad to 0.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
---
Probably material for stable as well (v3.3+).

 net/unix/diag.c |    1 +
 1 file changed, 1 insertion(+)
David Miller - Oct. 2, 2013, 8:08 p.m.
From: Mathias Krause <minipli@googlemail.com>
Date: Mon, 30 Sep 2013 22:05:40 +0200

> When filling the netlink message we miss to wipe the pad field,
> therefore leak one byte of heap memory to userland. Fix this by
> setting pad to 0.
> 
> Signed-off-by: Mathias Krause <minipli@googlemail.com>

Applied and queued up for -stable, thanks!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/unix/diag.c b/net/unix/diag.c
index d591091..86fa0f3 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -124,6 +124,7 @@  static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
 	rep->udiag_family = AF_UNIX;
 	rep->udiag_type = sk->sk_type;
 	rep->udiag_state = sk->sk_state;
+	rep->pad = 0;
 	rep->udiag_ino = sk_ino;
 	sock_diag_save_cookie(sk, rep->udiag_cookie);