Bluetooth: RFCOMM - Fix info leak via getsockname()
The RFCOMM code fails to initialize the trailing padding byte of struct sockaddr_rc added for alignment. It that for leaks one byte kernel stack via the getsockname() syscall. Add an explicit memset(0) before filling the structure to avoid the info leak. Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
f9432c5ec8
commit
9344a97296
|
@ -528,6 +528,7 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
|
|||
|
||||
BT_DBG("sock %p, sk %p", sock, sk);
|
||||
|
||||
memset(sa, 0, sizeof(*sa));
|
||||
sa->rc_family = AF_BLUETOOTH;
|
||||
sa->rc_channel = rfcomm_pi(sk)->channel;
|
||||
if (peer)
|
||||
|
|
Loading…
Reference in a new issue