Commit 184666c9 authored Jan 21, 2021 by Dan Carpenter Committed by Greg Kroah-Hartman Feb 03, 2021

can: dev: prevent potential information leak in can_fill_info()

[ Upstream commit b552766c872f5b0d90323b24e4c9e8fa67486dd5 ]

The "bec" struct isn't necessarily always initialized. For example, the
mcp251xfd_get_berr_counter() function doesn't initialize anything if the
interface is down.

Fixes: 52c793f2 ("can: netlink support for bus-error reporting and counters")
Link: https://lore.kernel.org/r/YAkaRdRJncsJO8Ve@mwanda


Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 8cbe9e35

drivers/net/can/dev.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1142,7 +1142,7 @@ static int can_fill_info(struct sk_buff skb, const struct net_device dev)
		{
		struct can_priv *priv = netdev_priv(dev);
		struct can_ctrlmode cm = {.flags = priv->ctrlmode};
		struct can_berr_counter bec;
		struct can_berr_counter bec = { };
		enum can_state state = priv->state;

		if (priv->do_get_state)