net: fix infoleak in llc

commit b8670c09f37bdf2847cc44f36511a53afc6161fd upstream.

The stack object â\80\9cinfoâ\80\9d has a total size of 12 bytes. Its last byte
is padding which is not initialized and leaked via â\80\9cput_cmsgâ\80\9d.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index c3ee805470667389f8c8cfe8d7b633e929474d80..9d140594082c655bcf2e4857deeff2b4de379693 100644 (file)
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -626,6 +626,7 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
        if (llc->cmsg_flags & LLC_CMSG_PKTINFO) {
                struct llc_pktinfo info;
 
+               memset(&info, 0, sizeof(info));
                info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex;
                llc_pdu_decode_dsap(skb, &info.lpi_sap);
                llc_pdu_decode_da(skb, info.lpi_mac);