From patchwork Fri Nov 12 01:06:59 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Rosenberg X-Patchwork-Id: 70899 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 2D239B713D for ; Fri, 12 Nov 2010 12:08:01 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755399Ab0KLBH5 (ORCPT ); Thu, 11 Nov 2010 20:07:57 -0500 Received: from mx1.vsecurity.com ([209.67.252.12]:60655 "EHLO mx1.vsecurity.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755156Ab0KLBH4 (ORCPT ); Thu, 11 Nov 2010 20:07:56 -0500 Received: (qmail 34752 invoked from network); 12 Nov 2010 01:07:49 -0000 Received: from unknown (HELO [10.0.2.186]) (drosenbe@[207.228.237.151]) (envelope-sender ) by mx1.vsecurity.com (qmail-ldap-1.03) with SMTP for ; 12 Nov 2010 01:07:49 -0000 Subject: [PATCH 2/10] Fix leaking of kernel heap addresses in net/ From: Dan Rosenberg To: "David S. Miller" , Oliver Hartkopp , Alexey Kuznetsov , Urs Thuermann , Hideaki YOSHIFUJI , Patrick McHardy , James Morris , Remi Denis-Courmont , "Pekka Savola (ipv6)" , Sridhar Samudrala , Vlad Yasevich , Tejun Heo , Eric Dumazet , Li Zefan , Joe Perches , Stephen Hemminger , Jamal Hadi Salim , "Eric W. Biederman" , Alexey Dobriyan , Jiri Pirko , Johannes Berg , Daniel Lezcano , Pavel Emelyanov , socketcan-core@lists.berlios.de, netdev@vger.kernel.org, linux-sctp@vger.kernel.org Date: Thu, 11 Nov 2010 20:06:59 -0500 Message-ID: <1289524019.5167.66.camel@dan> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/can/bcm.c b/net/can/bcm.c index 08ffe9e..5960ad7 100644 --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -165,9 +165,16 @@ static int bcm_proc_show(struct seq_file *m, void *v) struct bcm_sock *bo = bcm_sk(sk); struct bcm_op *op; - seq_printf(m, ">>> socket %p", sk->sk_socket); - seq_printf(m, " / sk %p", sk); - seq_printf(m, " / bo %p", bo); + /* Only expose kernel addresses to privileged readers */ + if (capable(CAP_NET_ADMIN)) + seq_printf(m, ">>> socket %p", sk->sk_socket); + seq_printf(m, " / sk %p", sk); + seq_printf(m, " / bo %p", bo); + else + seq_printf(m, ">>> socket %lu", sock_i_ino(sk)); + seq_printf(m, " / sk %d", 0); + seq_printf(m, " / bo %d", 0); + seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs); seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex)); seq_printf(m, " <<<\n"); @@ -1520,8 +1527,8 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, bo->bound = 1; if (proc_dir) { - /* unique socket address as filename */ - sprintf(bo->procname, "%p", sock); + /* unique socket inode as filename */ + sprintf(bo->procname, "%lx", sock_i_ino(sk)); bo->bcm_proc_read = proc_create_data(bo->procname, 0644, proc_dir, &bcm_proc_fops, sk);