OSDN Git Service
(root)
/
sagit-ice-cold
/
kernel_xiaomi_msm8998.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
0abc1ce
)
tcp: sysctl interface leaks 16 bytes of kernel memory
author
Alan Cox
<alan@linux.intel.com>
Thu, 11 Oct 2012 06:24:14 +0000
(06:24 +0000)
committer
David S. Miller
<davem@davemloft.net>
Thu, 11 Oct 2012 19:12:33 +0000
(15:12 -0400)
If the rc_dereference of tcp_fastopen_ctx ever fails then we copy 16 bytes
of kernel stack into the proc result.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/sysctl_net_ipv4.c
patch
|
blob
|
history
diff --git
a/net/ipv4/sysctl_net_ipv4.c
b/net/ipv4/sysctl_net_ipv4.c
index
9205e49
..
63d4ecc
100644
(file)
--- a/
net/ipv4/sysctl_net_ipv4.c
+++ b/
net/ipv4/sysctl_net_ipv4.c
@@
-248,6
+248,8
@@
int proc_tcp_fastopen_key(ctl_table *ctl, int write, void __user *buffer,
ctxt = rcu_dereference(tcp_fastopen_ctx);
if (ctxt)
memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
+ else
+ memset(user_key, 0, sizeof(user_key));
rcu_read_unlock();
snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x",