This is a note to let you know that I've just added the patch titled
rtnl: fix info leak on RTM_GETLINK request for VF devices
to the 3.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rtnl-fix-info-leak-on-rtm_getlink-request-for-vf-devices.patch
and it can be found in the queue-3.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 47e13bb5773197bef46b59e359e5281de3672d57 Mon Sep 17 00:00:00 2001
From: Mathias Krause <minipli@xxxxxxxxxxxxxx>
Date: Sat, 9 Mar 2013 05:52:20 +0000
Subject: rtnl: fix info leak on RTM_GETLINK request for VF devices
From: Mathias Krause <minipli@xxxxxxxxxxxxxx>
[ Upstream commit 84d73cd3fb142bf1298a8c13fd4ca50fd2432372 ]
Initialize the mac address buffer with 0 as the driver specific function
will probably not fill the whole buffer. In fact, all in-kernel drivers
fill only ETH_ALEN of the MAX_ADDR_LEN bytes, i.e. 6 of the 32 possible
bytes. Therefore we currently leak 26 bytes of stack memory to userland
via the netlink interface.
Signed-off-by: Mathias Krause <minipli@xxxxxxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/core/rtnetlink.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -963,6 +963,7 @@ static int rtnl_fill_ifinfo(struct sk_bu
struct ifla_vf_mac vf_mac;
struct ifla_vf_vlan vf_vlan;
struct ifla_vf_tx_rate vf_tx_rate;
+ memset(ivi.mac, 0, sizeof(ivi.mac));
if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi))
break;
vf_mac.vf = vf_vlan.vf = vf_tx_rate.vf = ivi.vf;
Patches currently in stable-queue which might be from minipli@xxxxxxxxxxxxxx are
queue-3.0/dcbnl-fix-various-netlink-info-leaks.patch
queue-3.0/rtnl-fix-info-leak-on-rtm_getlink-request-for-vf-devices.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html