lkml.org 
[lkml]   [2022]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 019/599] af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
    Date
    From: Haimin Zhang <tcs_kernel@tencent.com>

    [ Upstream commit 9a564bccb78a76740ea9d75a259942df8143d02c ]

    Add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
    to initialize the buffer of supp_skb to fix a kernel-info-leak issue.
    1) Function pfkey_register calls compose_sadb_supported to request
    a sk_buff. 2) compose_sadb_supported calls alloc_sbk to allocate
    a sk_buff, but it doesn't zero it. 3) If auth_len is greater 0, then
    compose_sadb_supported treats the memory as a struct sadb_supported and
    begins to initialize. But it just initializes the field sadb_supported_len
    and field sadb_supported_exttype without field sadb_supported_reserved.

    Reported-by: TCS Robot <tcs_robot@tencent.com>
    Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/key/af_key.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/key/af_key.c b/net/key/af_key.c
    index d1364b858fdf..bd9b5c573b5a 100644
    --- a/net/key/af_key.c
    +++ b/net/key/af_key.c
    @@ -1703,7 +1703,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad

    xfrm_probe_algs();

    - supp_skb = compose_sadb_supported(hdr, GFP_KERNEL);
    + supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO);
    if (!supp_skb) {
    if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC)
    pfk->registered &= ~(1<<hdr->sadb_msg_satype);
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-04-06 02:32    [W:2.295 / U:0.576 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site