Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933873Ab3CRVri (ORCPT ); Mon, 18 Mar 2013 17:47:38 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:45745 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755911Ab3CRVHU (ORCPT ); Mon, 18 Mar 2013 17:07:20 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stephen Hemminger , Mathias Krause , "David S. Miller" Subject: [ 70/75] bridge: fix mdb info leaks Date: Mon, 18 Mar 2013 14:07:33 -0700 Message-Id: <20130318210515.305143741@linuxfoundation.org> X-Mailer: git-send-email 1.8.1.2.434.g9a6c84e.dirty In-Reply-To: <20130318210510.203500214@linuxfoundation.org> References: <20130318210510.203500214@linuxfoundation.org> User-Agent: quilt/0.60-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2020 Lines: 65 3.8-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mathias Krause [ Upstream commit c085c49920b2f900ba716b4ca1c1a55ece9872cc ] The bridging code discloses heap and stack bytes via the RTM_GETMDB netlink interface and via the notify messages send to group RTNLGRP_MDB afer a successful add/del. Fix both cases by initializing all unset members/padding bytes with memset(0). Cc: Stephen Hemminger Signed-off-by: Mathias Krause Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/bridge/br_mdb.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/net/bridge/br_mdb.c +++ b/net/bridge/br_mdb.c @@ -82,6 +82,7 @@ static int br_mdb_fill_info(struct sk_bu port = p->port; if (port) { struct br_mdb_entry e; + memset(&e, 0, sizeof(e)); e.ifindex = port->dev->ifindex; e.state = p->state; if (p->addr.proto == htons(ETH_P_IP)) @@ -138,6 +139,7 @@ static int br_mdb_dump(struct sk_buff *s break; bpm = nlmsg_data(nlh); + memset(bpm, 0, sizeof(*bpm)); bpm->ifindex = dev->ifindex; if (br_mdb_fill_info(skb, cb, dev) < 0) goto out; @@ -173,6 +175,7 @@ static int nlmsg_populate_mdb_fill(struc return -EMSGSIZE; bpm = nlmsg_data(nlh); + memset(bpm, 0, sizeof(*bpm)); bpm->family = AF_BRIDGE; bpm->ifindex = dev->ifindex; nest = nla_nest_start(skb, MDBA_MDB); @@ -230,6 +233,7 @@ void br_mdb_notify(struct net_device *de { struct br_mdb_entry entry; + memset(&entry, 0, sizeof(entry)); entry.ifindex = port->dev->ifindex; entry.addr.proto = group->proto; entry.addr.u.ip4 = group->u.ip4; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/