Commit 5899f047 authored by Jiri Benc's avatar Jiri Benc Committed by David S. Miller

netlink: pad nla_memcpy dest buffer with zeroes

This is especially important in cases where the kernel allocs a new
structure and expects a field to be set from a netlink attribute. If such
attribute is shorter than expected, the rest of the field is left containing
previous data. When such field is read back by the user space, kernel memory
content is leaked.
Signed-off-by: 's avatarJiri Benc <jbenc@redhat.com>
Acked-by: 's avatarThomas Graf <tgraf@suug.ch>
Signed-off-by: 's avatarDavid S. Miller <davem@davemloft.net>
parent f5e2dc5d
......@@ -279,6 +279,8 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count)
int minlen = min_t(int, count, nla_len(src));
memcpy(dest, nla_data(src), minlen);
if (count > minlen)
memset(dest + minlen, 0, count - minlen);
return minlen;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment