diff options
| author | Mathias Krause <minipli@googlemail.com> | 2012-09-19 11:33:39 +0000 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2014-02-10 16:10:59 -0500 |
| commit | 59bed844deb2e6fc82fbf8bf98531b86192474e2 (patch) | |
| tree | 33ef0aa3a7e90d1a6faa5033c2c96ab764b4b9c3 /net | |
| parent | 19c389a4254b2e0194a5430c8889acc0ef479386 (diff) | |
xfrm_user: fix info leak in copy_to_user_state()
commit f778a636713a435d3a922c60b1622a91136560c1 upstream.
The memory reserved to dump the xfrm state includes the padding bytes of
struct xfrm_usersa_info added by the compiler for alignment (7 for
amd64, 3 for i386). Add an explicit memset(0) before filling the buffer
to avoid the info leak.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/xfrm/xfrm_user.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 6106b72826d3..a0039040aba6 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -598,6 +598,7 @@ out: static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p) { + memset(p, 0, sizeof(*p)); memcpy(&p->id, &x->id, sizeof(p->id)); memcpy(&p->sel, &x->sel, sizeof(p->sel)); memcpy(&p->lft, &x->lft, sizeof(p->lft)); |