| commit | 775ad2a81199393161e6293f86fcbcd75a2ddb65 | |
| author | Mathias Krause <minipli@googlemail.com> | |
| Sun, 7 Apr 2013 01:51:54 +0000 (7 01:51 +0000) | ||
| committer | Willy Tarreau <w@1wt.eu> | |
| Mon, 10 Jun 2013 09:43:43 +0000 (10 11:43 +0200) | ||
| tree | 0088f96bfa9c7be719e078f369f3cbf0a2fe770d | treesnapshot (tar.gz zip) |
| parent | 3822b3c57419e02ee9d8604ec9fbad832ade55ce | commitdiff |
iucv: Fix missing msg_namelen update in iucv_sock_recvmsg()
[ Upstream commit a5598bd9c087dc0efc250a5221e5d0e6f584ee88 ]
The current code does not fill the msg_name member in case it is set.
It also does not set the msg_namelen member to 0 and therefore makes
net/socket.c leak the local, uninitialized sockaddr_storage variable
to userland -- 128 bytes of kernel stack memory.
Fix that by simply setting msg_namelen to 0 as obviously nobody cared
about iucv_sock_recvmsg() not filling the msg_name in case it was set.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
[ Upstream commit a5598bd9c087dc0efc250a5221e5d0e6f584ee88 ]
The current code does not fill the msg_name member in case it is set.
It also does not set the msg_namelen member to 0 and therefore makes
net/socket.c leak the local, uninitialized sockaddr_storage variable
to userland -- 128 bytes of kernel stack memory.
Fix that by simply setting msg_namelen to 0 as obviously nobody cared
about iucv_sock_recvmsg() not filling the msg_name in case it was set.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
| net/iucv/af_iucv.c | diffblobblamehistory |