lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sun,  7 Apr 2013 13:51:47 +0200
From:	Mathias Krause <>
To:	"David S. Miller" <>
	Allan Stephens <>,
	Aloisio Almeida Jr <>,
	Andy King <>,
	Arnaldo Carvalho de Melo <>,
	Dmitry Torokhov <>,
	George Zhang <>,
	Gustavo Padovan <>,
	Johan Hedberg <>,
	Jon Maloy <>,
	Lauro Ramos Venancio <>,
	Marcel Holtmann <>,
	Ralf Baechle <>,
	Samuel Ortiz <>,
	Samuel Ortiz <>,
	Sjur Braendeland <>,
	Ursula Braun <>,
	Brad Spengler <>,
	Mathias Krause <>
Subject: [PATCH 01/16] atm: update msg_namelen in vcc_recvmsg()

The current code does not fill the msg_name member in case it is set.
It also does not set the msg_namelen member to 0 and therefore makes
net/socket.c leak the local, uninitialized sockaddr_storage variable
to userland -- 128 bytes of kernel stack memory.

Fix that by simply setting msg_namelen to 0 as obviously nobody cared
about vcc_recvmsg() not filling the msg_name in case it was set.

Signed-off-by: Mathias Krause <>
 net/atm/common.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/atm/common.c b/net/atm/common.c
index 7b49100..737bef5 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -531,6 +531,8 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
 	struct sk_buff *skb;
 	int copied, error = -EINVAL;
+	msg->msg_namelen = 0;
 	if (sock->state != SS_CONNECTED)
 		return -ENOTCONN;

To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists