Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5dbd5068 authored by Amerigo Wang's avatar Amerigo Wang Committed by David S. Miller
Browse files

ipv6,gre: do not leak info to user-space 



There is a hole in struct ip6_tnl_parm2, so we have to
zero the struct on stack before copying it to user-space.

Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: default avatarCong Wang <amwang@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d34710e3

net/ipv6/ip6_gre.c

+2 −0
Original line number Diff line number Diff line
@@ -1081,6 +1081,7 @@ static int ip6gre_tunnel_ioctl(struct net_device *dev, 
		}

		if (t == NULL)

			t = netdev_priv(dev);

		memset(&p, 0, sizeof(p));

		ip6gre_tnl_parm_to_user(&p, &t->parms);

		if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))

			err = -EFAULT;
@@ -1128,6 +1129,7 @@ static int ip6gre_tunnel_ioctl(struct net_device *dev, 
		if (t) {

			err = 0;



			memset(&p, 0, sizeof(p));

			ip6gre_tnl_parm_to_user(&p, &t->parms);

			if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))

				err = -EFAULT;