aboutsummaryrefslogtreecommitdiff
path: root/net/dccp
diff options
context:
space:
mode:
authorMathias Krause <minipli@googlemail.com>2012-08-15 11:31:53 +0000
committerDavid S. Miller <davem@davemloft.net>2012-08-15 21:36:31 -0700
commit3592aaeb80290bda0f2cf0b5456c97bfc638b192 (patch)
tree01a4eb39de130787cdf321fe1c39896e47d1a1eb /net/dccp
parent04d4fbca1017c11381e7d82acea21dd741e748bc (diff)
llc: fix info leak via getsockname()
The LLC code wrongly returns 0, i.e. "success", when the socket is zapped. Together with the uninitialized uaddrlen pointer argument from sys_getsockname this leads to an arbitrary memory leak of up to 128 bytes kernel stack via the getsockname() syscall. Return an error instead when the socket is zapped to prevent the info leak. Also remove the unnecessary memset(0). We don't directly write to the memory pointed by uaddr but memcpy() a local structure at the end of the function that is properly initialized. Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/dccp')
0 files changed, 0 insertions, 0 deletions