lkml.org 
[lkml]   [2012]   [Sep]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 018/218] llc: fix info leak via getsockname()
    Date
    3.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------


    From: Mathias Krause <minipli@googlemail.com>

    [ Upstream commit 3592aaeb80290bda0f2cf0b5456c97bfc638b192 ]

    The LLC code wrongly returns 0, i.e. "success", when the socket is
    zapped. Together with the uninitialized uaddrlen pointer argument from
    sys_getsockname this leads to an arbitrary memory leak of up to 128
    bytes kernel stack via the getsockname() syscall.

    Return an error instead when the socket is zapped to prevent the info
    leak. Also remove the unnecessary memset(0). We don't directly write to
    the memory pointed by uaddr but memcpy() a local structure at the end of
    the function that is properly initialized.

    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/llc/af_llc.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/net/llc/af_llc.c
    +++ b/net/llc/af_llc.c
    @@ -971,14 +971,13 @@ static int llc_ui_getname(struct socket
    struct sockaddr_llc sllc;
    struct sock *sk = sock->sk;
    struct llc_sock *llc = llc_sk(sk);
    - int rc = 0;
    + int rc = -EBADF;

    memset(&sllc, 0, sizeof(sllc));
    lock_sock(sk);
    if (sock_flag(sk, SOCK_ZAPPED))
    goto out;
    *uaddrlen = sizeof(sllc);
    - memset(uaddr, 0, *uaddrlen);
    if (peer) {
    rc = -ENOTCONN;
    if (sk->sk_state != TCP_ESTABLISHED)



    \
     
     \ /
      Last update: 2012-09-29 01:01    [W:4.024 / U:0.404 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site