Skip to content

Commit d26d650

Browse files
miniplidavem330
authored andcommitted
NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg()
The code in llcp_sock_recvmsg() does not initialize all the members of struct sockaddr_nfc_llcp when filling the sockaddr info. Nor does it initialize the padding bytes of the structure inserted by the compiler for alignment. Also, if the socket is in state LLCP_CLOSED or is shutting down during receive the msg_namelen member is not updated to 0 while otherwise returning with 0, i.e. "success". The msg_namelen update is also missing for stream and seqpacket sockets which don't fill the sockaddr info. Both issues lead to the fact that the code will leak uninitialized kernel stack bytes in net/socket.c. Fix the first issue by initializing the memory used for sockaddr info with memset(0). Fix the second one by setting msg_namelen to 0 early. It will be updated later if we're going to fill the msg_name member. Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org> Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org> Cc: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 3ce5efa commit d26d650

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

Diff for: net/nfc/llcp/sock.c

+3
Original file line numberDiff line numberDiff line change
@@ -646,6 +646,8 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
646646

647647
pr_debug("%p %zu\n", sk, len);
648648

649+
msg->msg_namelen = 0;
650+
649651
lock_sock(sk);
650652

651653
if (sk->sk_state == LLCP_CLOSED &&
@@ -691,6 +693,7 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
691693

692694
pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
693695

696+
memset(sockaddr, 0, sizeof(*sockaddr));
694697
sockaddr->sa_family = AF_NFC;
695698
sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP;
696699
sockaddr->dsap = ui_cb->dsap;

0 commit comments

Comments
 (0)