3.8-stable review patch. If anyone has any objections, please let me know.
------------------ From: Mathias Krause <[email protected]> [ Upstream commit c085c49920b2f900ba716b4ca1c1a55ece9872cc ] The bridging code discloses heap and stack bytes via the RTM_GETMDB netlink interface and via the notify messages send to group RTNLGRP_MDB afer a successful add/del. Fix both cases by initializing all unset members/padding bytes with memset(0). Cc: Stephen Hemminger <[email protected]> Signed-off-by: Mathias Krause <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> --- net/bridge/br_mdb.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/net/bridge/br_mdb.c +++ b/net/bridge/br_mdb.c @@ -82,6 +82,7 @@ static int br_mdb_fill_info(struct sk_bu port = p->port; if (port) { struct br_mdb_entry e; + memset(&e, 0, sizeof(e)); e.ifindex = port->dev->ifindex; e.state = p->state; if (p->addr.proto == htons(ETH_P_IP)) @@ -138,6 +139,7 @@ static int br_mdb_dump(struct sk_buff *s break; bpm = nlmsg_data(nlh); + memset(bpm, 0, sizeof(*bpm)); bpm->ifindex = dev->ifindex; if (br_mdb_fill_info(skb, cb, dev) < 0) goto out; @@ -173,6 +175,7 @@ static int nlmsg_populate_mdb_fill(struc return -EMSGSIZE; bpm = nlmsg_data(nlh); + memset(bpm, 0, sizeof(*bpm)); bpm->family = AF_BRIDGE; bpm->ifindex = dev->ifindex; nest = nla_nest_start(skb, MDBA_MDB); @@ -230,6 +233,7 @@ void br_mdb_notify(struct net_device *de { struct br_mdb_entry entry; + memset(&entry, 0, sizeof(entry)); entry.ifindex = port->dev->ifindex; entry.addr.proto = group->proto; entry.addr.u.ip4 = group->u.ip4; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
