Skip to content

Commit 792039c

Browse files
miniplidavem330
authored andcommitted
Bluetooth: L2CAP - Fix info leak via getsockname()
The L2CAP code fails to initialize the l2_bdaddr_type member of struct sockaddr_l2 and the padding byte added for alignment. It that for leaks two bytes kernel stack via the getsockname() syscall. Add an explicit memset(0) before filling the structure to avoid the info leak. Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 9344a97 commit 792039c

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

Diff for: net/bluetooth/l2cap_sock.c

+1
Original file line numberDiff line numberDiff line change
@@ -245,6 +245,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
245245

246246
BT_DBG("sock %p, sk %p", sock, sk);
247247

248+
memset(la, 0, sizeof(struct sockaddr_l2));
248249
addr->sa_family = AF_BLUETOOTH;
249250
*len = sizeof(struct sockaddr_l2);
250251

0 commit comments

Comments
 (0)