| Message ID | 1288448782-5582-1-git-send-email-segooon@gmail.com |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | David Miller |
| Headers | show |
Hi Vasiiy, > Structure bnep_conninfo is copied to userland with the field "device" > that has the last elements unitialized. It leads to leaking of > contents of kernel stack memory. > > Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Regards Marcel -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
* Marcel Holtmann <marcel@holtmann.org> [2010-11-02 16:35:31 +0100]: > Hi Vasiiy, > > > Structure bnep_conninfo is copied to userland with the field "device" > > that has the last elements unitialized. It leads to leaking of > > contents of kernel stack memory. > > > > Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> > > Acked-by: Marcel Holtmann <marcel@holtmann.org> Applied, thanks.
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c index f10b41f..5868597 100644 --- a/net/bluetooth/bnep/core.c +++ b/net/bluetooth/bnep/core.c @@ -648,6 +648,7 @@ int bnep_del_connection(struct bnep_conndel_req *req) static void __bnep_copy_ci(struct bnep_conninfo *ci, struct bnep_session *s) { + memset(ci, 0, sizeof(*ci)); memcpy(ci->dst, s->eh.h_source, ETH_ALEN); strcpy(ci->device, s->dev->name); ci->flags = s->flags;
Structure bnep_conninfo is copied to userland with the field "device" that has the last elements unitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> --- Compile tested. net/bluetooth/bnep/core.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)