On 19 May 2016 at 11:08, Jiri Slaby <jsl...@suse.cz> wrote:
> From: Kangjie Lu <kangji...@gmail.com>
>
> 3.12-stable review patch. If anyone has any objections, please let me know.
>
> ===============
>
> [ Upstream commit 5f8e44741f9f216e33736ea4ec65ca9ac03036e6 ]
>
> The stack object “map” has a total size of 32 bytes. Its last 4
> bytes are padding generated by compiler. These padding bytes are
> not initialized and sent out via “nla_put”.
>
> Signed-off-by: Kangjie Lu <k...@gatech.edu>
> Signed-off-by: David S. Miller <da...@davemloft.net>
> Signed-off-by: Jiri Slaby <jsl...@suse.cz>
> ---
> net/core/rtnetlink.c | 18 ++++++++++--------
> 1 file changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index fd3a16e45dd9..5093f42d7afc 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -950,14 +950,16 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct
> net_device *dev,
> goto nla_put_failure;
>
> if (1) {
> - struct rtnl_link_ifmap map = {
> - .mem_start = dev->mem_start,
> - .mem_end = dev->mem_end,
> - .base_addr = dev->base_addr,
> - .irq = dev->irq,
> - .dma = dev->dma,
> - .port = dev->if_port,
> - };
> + struct rtnl_link_ifmap map;
> +
> + memset(&map, 0, sizeof(map));
> + map.mem_start = dev->mem_start;
> + map.mem_end = dev->mem_end;
> + map.base_addr = dev->base_addr;
> + map.irq = dev->irq;
> + map.dma = dev->dma;
> + map.port = dev->if_port;
> +
> if (nla_put(skb, IFLA_MAP, sizeof(map), &map))
> goto nla_put_failure;
> }
> --
> 2.8.2
>
Just out of curiosity, was this observed in practice? I could be
wrong, but I was under the impression that using designated
initializers would zero the rest of the struct, including padding.
This seems to back that up:
http://stackoverflow.com/a/3374468/1697183
If this is indeed a real info leak, then I would assume we have much
bigger problems around the kernel.
Vegard
