Skip to content

Commit d31fcd0

Browse files
kengiternasty007
authored andcommitted
fix infoleak in rtnetlink
the stack object “map” has a total size of 32 bytes. Its last 4 bytes are padding generated by compiler. These padding bytes are not initialized and sent out via “nla_put” Bug: 28620102 Change-Id: I13da380c6fe8abca49e3cf9f05293c02b44d2e5e Signed-off-by: kangjie <[email protected]>
1 parent d545330 commit d31fcd0

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

net/core/rtnetlink.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -924,14 +924,14 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
924924
NLA_PUT_STRING(skb, IFLA_IFALIAS, dev->ifalias);
925925

926926
if (1) {
927-
struct rtnl_link_ifmap map = {
928-
.mem_start = dev->mem_start,
929-
.mem_end = dev->mem_end,
930-
.base_addr = dev->base_addr,
931-
.irq = dev->irq,
932-
.dma = dev->dma,
933-
.port = dev->if_port,
934-
};
927+
struct rtnl_link_ifmap map;
928+
memset(&map, 0, sizeof(map));
929+
map.mem_start = dev->mem_start;
930+
map.mem_end = dev->mem_end;
931+
map.base_addr = dev->base_addr;
932+
map.irq = dev->irq;
933+
map.dma = dev->dma;
934+
map.port = dev->if_port;
935935
NLA_PUT(skb, IFLA_MAP, sizeof(map), &map);
936936
}
937937

0 commit comments

Comments
 (0)