lkml.org 
[lkml]   [2013]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 039/118] NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg()
    Date
    3.5.7.12 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Mathias Krause <minipli@googlemail.com>

    commit d26d6504f23e803824e8ebd14e52d4fc0a0b09cb upstream.

    The code in llcp_sock_recvmsg() does not initialize all the members of
    struct sockaddr_nfc_llcp when filling the sockaddr info. Nor does it
    initialize the padding bytes of the structure inserted by the compiler
    for alignment.

    Also, if the socket is in state LLCP_CLOSED or is shutting down during
    receive the msg_namelen member is not updated to 0 while otherwise
    returning with 0, i.e. "success". The msg_namelen update is also
    missing for stream and seqpacket sockets which don't fill the sockaddr
    info.

    Both issues lead to the fact that the code will leak uninitialized
    kernel stack bytes in net/socket.c.

    Fix the first issue by initializing the memory used for sockaddr info
    with memset(0). Fix the second one by setting msg_namelen to 0 early.
    It will be updated later if we're going to fill the msg_name member.

    Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
    Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
    Cc: Samuel Ortiz <sameo@linux.intel.com>
    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [ luis: 3.5 is not affected by first issue. ]
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    net/nfc/llcp/sock.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
    index e06d458..80200ac 100644
    --- a/net/nfc/llcp/sock.c
    +++ b/net/nfc/llcp/sock.c
    @@ -570,6 +570,8 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,

    pr_debug("%p %zu\n", sk, len);

    + msg->msg_namelen = 0;
    +
    lock_sock(sk);

    if (sk->sk_state == LLCP_CLOSED &&
    --
    1.8.1.2


    \
     
     \ /
      Last update: 2013-05-07 21:41    [W:4.125 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site