diff options
| author | Haimin Zhang <tcs_kernel@tencent.com> | 2022-03-08 11:20:28 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-04-20 09:06:28 +0200 |
| commit | 7b0e01a9b7f2aaeb6fa73b35864b1d7dc6e795c4 (patch) | |
| tree | 2454dfca40d68da1a510ab249bd33fbe96bad8a6 /net | |
| parent | a322170ed71705d975c674886724f2bb43c17189 (diff) | |
| download | linux-7b0e01a9b7f2aaeb6fa73b35864b1d7dc6e795c4.tar.gz linux-7b0e01a9b7f2aaeb6fa73b35864b1d7dc6e795c4.tar.bz2 linux-7b0e01a9b7f2aaeb6fa73b35864b1d7dc6e795c4.zip | |
af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
[ Upstream commit 9a564bccb78a76740ea9d75a259942df8143d02c ]
Add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
to initialize the buffer of supp_skb to fix a kernel-info-leak issue.
1) Function pfkey_register calls compose_sadb_supported to request
a sk_buff. 2) compose_sadb_supported calls alloc_sbk to allocate
a sk_buff, but it doesn't zero it. 3) If auth_len is greater 0, then
compose_sadb_supported treats the memory as a struct sadb_supported and
begins to initialize. But it just initializes the field sadb_supported_len
and field sadb_supported_exttype without field sadb_supported_reserved.
Reported-by: TCS Robot <tcs_robot@tencent.com>
Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/key/af_key.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/key/af_key.c b/net/key/af_key.c index adc93329e6aa..3f7e27c1aa83 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1726,7 +1726,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad xfrm_probe_algs(); - supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); + supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO); if (!supp_skb) { if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) pfk->registered &= ~(1<<hdr->sadb_msg_satype); |