WSL2-Linux-Kernel/net/tipc
Mathias Krause 60085c3d00 tipc: fix info leaks via msg_name in recv_msg/recv_stream
The code in set_orig_addr() does not initialize all of the members of
struct sockaddr_tipc when filling the sockaddr info -- namely the union
is only partly filled. This will make recv_msg() and recv_stream() --
the only users of this function -- leak kernel stack memory as the
msg_name member is a local variable in net/socket.c.

Additionally to that both recv_msg() and recv_stream() fail to update
the msg_namelen member to 0 while otherwise returning with 0, i.e.
"success". This is the case for, e.g., non-blocking sockets. This will
lead to a 128 byte kernel stack leak in net/socket.c.

Fix the first issue by initializing the memory of the union with
memset(0). Fix the second one by setting msg_namelen to 0 early as it
will be updated later if we're going to fill the msg_name member.

Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-04-07 16:28:02 -04:00
..
Kconfig net/tipc: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:40:02 -08:00
Makefile tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
addr.c tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
addr.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
bcast.c tipc: fix missing spinlock init in broadcast code 2013-02-15 15:40:56 -05:00
bcast.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
bearer.c tipc: remove the bearer congestion mechanism 2012-11-21 20:07:25 -05:00
bearer.h tipc: remove the bearer congestion mechanism 2012-11-21 20:07:25 -05:00
config.c tipc: eliminate configuration for maximum number of name publications 2012-08-20 02:26:31 -07:00
config.h tipc: Optimize re-initialization of configuration service 2012-04-26 17:19:07 -04:00
core.c tipc: delete TIPC_ADVANCED Kconfig variable 2012-11-22 14:33:29 -05:00
core.h tipc: eliminate configuration for maximum number of name publications 2012-08-20 02:26:31 -07:00
discover.c tipc: remove the bearer congestion mechanism 2012-11-21 20:07:25 -05:00
discover.h tipc: rename struct link* to struct tipc_link* 2011-12-29 21:53:30 -05:00
eth_media.c tipc: fix lockdep warning during bearer initialization 2012-08-20 02:26:30 -07:00
handler.c tipc: do not use tasklet_disable before tasklet_kill 2012-11-03 15:10:14 -04:00
link.c tipc: remove obsolete flush of stale reassembly buffer 2012-12-06 17:20:19 -05:00
link.h tipc: remove the bearer congestion mechanism 2012-11-21 20:07:25 -05:00
log.c tipc: remove print_buf and deprecated log buffer code 2012-07-13 19:34:43 -04:00
msg.c tipc: remove TIPC packet debugging functions and macros 2012-07-13 19:25:16 -04:00
msg.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
name_distr.c tipc: eliminate an unnecessary cast of node variable 2012-11-22 14:33:28 -05:00
name_distr.h [NET] TIPC: Fix whitespace errors. 2007-02-10 23:20:15 -08:00
name_table.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
name_table.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
net.c tipc: change tipc_net_start routine return value type 2012-08-20 02:26:30 -07:00
net.h tipc: change tipc_net_start routine return value type 2012-08-20 02:26:30 -07:00
netlink.c netlink: Rename pid to portid to avoid confusion 2012-09-10 15:30:41 -04:00
node.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
node.h tipc: rename supported flag to recv_permitted 2012-11-22 07:50:51 -05:00
node_subscr.c tipc: use standard printk shortcut macros (pr_err etc.) 2012-07-13 19:24:44 -04:00
node_subscr.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
port.c tipc: standardize across connect/disconnect function naming 2012-12-07 17:23:19 -05:00
port.h tipc: standardize across connect/disconnect function naming 2012-12-07 17:23:19 -05:00
ref.c tipc: use standard printk shortcut macros (pr_err etc.) 2012-07-13 19:24:44 -04:00
ref.h tipc: cleanup function namespace 2010-10-16 11:13:24 -07:00
socket.c tipc: fix info leaks via msg_name in recv_msg/recv_stream 2013-04-07 16:28:02 -04:00
subscr.c tipc: standardize across connect/disconnect function naming 2012-12-07 17:23:19 -05:00
subscr.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00