Skip to content

Commit 9344a97

Browse files
miniplidavem330
authored andcommitted
Bluetooth: RFCOMM - Fix info leak via getsockname()
The RFCOMM code fails to initialize the trailing padding byte of struct sockaddr_rc added for alignment. It that for leaks one byte kernel stack via the getsockname() syscall. Add an explicit memset(0) before filling the structure to avoid the info leak. Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent f9432c5 commit 9344a97

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

Diff for: net/bluetooth/rfcomm/sock.c

+1
Original file line numberDiff line numberDiff line change
@@ -528,6 +528,7 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
528528

529529
BT_DBG("sock %p, sk %p", sock, sk);
530530

531+
memset(sa, 0, sizeof(*sa));
531532
sa->rc_family = AF_BLUETOOTH;
532533
sa->rc_channel = rfcomm_pi(sk)->channel;
533534
if (peer)

0 commit comments

Comments
 (0)