diff options
| author | Jiri Benc <jbenc@redhat.com> | 2015-03-29 16:05:28 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-03-31 14:07:24 -0400 |
| commit | 5899f0478528b59ea9ced201eacb3e56ca406c39 (patch) | |
| tree | b260bb0d9c9089954268ba60a625f0d995334060 | |
| parent | f5e2dc5d7fe78fe4d8748d217338f4f7b6a5d7ea (diff) | |
| download | ibft-5899f0478528b59ea9ced201eacb3e56ca406c39.tar.gz | |
netlink: pad nla_memcpy dest buffer with zeroes
This is especially important in cases where the kernel allocs a new
structure and expects a field to be set from a netlink attribute. If such
attribute is shorter than expected, the rest of the field is left containing
previous data. When such field is read back by the user space, kernel memory
content is leaked.
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | lib/nlattr.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/nlattr.c b/lib/nlattr.c index 76a1b59523ab05..f5907d23272d48 100644 --- a/lib/nlattr.c +++ b/lib/nlattr.c @@ -279,6 +279,8 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count) int minlen = min_t(int, count, nla_len(src)); memcpy(dest, nla_data(src), minlen); + if (count > minlen) + memset(dest + minlen, 0, count - minlen); return minlen; } |