diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-08-16 03:14:04 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-08-20 02:21:30 -0700 |
| commit | 5ef5d6c569f80cf716d75fa88e9b5ee72f0986b2 (patch) | |
| tree | d8d85f656645a41afa15ff5ac11cf4e5eddf841f /net/ipv6/ip6_tunnel.c | |
| parent | 56892261ed1a854db5363df8bb3fbdb2c6c28d4c (diff) | |
| download | linux-3.10-5ef5d6c569f80cf716d75fa88e9b5ee72f0986b2.tar.gz linux-3.10-5ef5d6c569f80cf716d75fa88e9b5ee72f0986b2.tar.bz2 linux-3.10-5ef5d6c569f80cf716d75fa88e9b5ee72f0986b2.zip | |
gre: information leak in ip6_tnl_ioctl()
There is a one byte hole between p->hop_limit and p->flowinfo where
stack memory is leaked to the user. This was introduced in c12b395a46
"gre: Support GRE over IPv6".
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Diffstat (limited to 'net/ipv6/ip6_tunnel.c')
| -rw-r--r-- | net/ipv6/ip6_tunnel.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 33d2a0e6712..cb7e2ded6f0 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1312,6 +1312,8 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) } ip6_tnl_parm_from_user(&p1, &p); t = ip6_tnl_locate(net, &p1, 0); + } else { + memset(&p, 0, sizeof(p)); } if (t == NULL) t = netdev_priv(dev); |