diff options
| author | Alan Cox <alan@linux.intel.com> | 2012-10-11 06:24:14 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-10-11 15:12:33 -0400 |
| commit | 0e24c4fc52b16f0a1102a933f636d2f350c41098 (patch) | |
| tree | 8d70e83af6991d7d997a9638602618e59e12f718 | |
| parent | 0abc1ceec52fcb9f962a2cd52e89baccccbc1d2e (diff) | |
| download | lwn-0e24c4fc52b16f0a1102a933f636d2f350c41098.tar.gz lwn-0e24c4fc52b16f0a1102a933f636d2f350c41098.zip | |
tcp: sysctl interface leaks 16 bytes of kernel memory
If the rc_dereference of tcp_fastopen_ctx ever fails then we copy 16 bytes
of kernel stack into the proc result.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv4/sysctl_net_ipv4.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index 9205e492dc9d..63d4eccc674d 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -248,6 +248,8 @@ int proc_tcp_fastopen_key(ctl_table *ctl, int write, void __user *buffer, ctxt = rcu_dereference(tcp_fastopen_ctx); if (ctxt) memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH); + else + memset(user_key, 0, sizeof(user_key)); rcu_read_unlock(); snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x", |