From 760a84d4c1b24bad30f527ff2f4682173fc20f5b Mon Sep 17 00:00:00 2001 From: sohu0106 Date: Sun, 30 Jul 2017 11:51:18 +0800 Subject: [PATCH] Update af_irda.c Sometimes irda_getsockopt() doesn't initialize all members of list field of irda_device_list struct. This structure is then copied to userland. It leads to leaking of contents of kernel stack memory. We have to initialize them to zero , or it will allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure --- net/irda/af_irda.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c index 2e6990f8b80b6b..ce55458a88a638 100644 --- a/net/irda/af_irda.c +++ b/net/irda/af_irda.c @@ -2248,6 +2248,8 @@ static int irda_getsockopt(struct socket *sock, int level, int optname, err = -EINVAL; goto out; } + + memset( &list, 0, sizeof(struct irda_device_list) ); /* Ask lmp for the current discovery log */ discoveries = irlmp_get_discoveries(&list.len, self->mask.word,