Message ID | 20230209091648.GA5858@ubuntu (mailing list archive) |
---|---|
State | Accepted |
Commit | 2f4796518315ab246638db8feebfcb494212e7ee |
Delegated to: | Netdev Maintainers |
Headers | show |
Series | [v2] af_key: Fix heap information leak | expand |
2023-02-09, 01:16:48 -0800, Hyunwoo Kim wrote: > Since x->encap of pfkey_msg2xfrm_state() is not > initialized to 0, kernel heap data can be leaked. > > Fix with kzalloc() to prevent this. > > Signed-off-by: Hyunwoo Kim <v4bel@theori.io> > Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Thanks. > --- > net/key/af_key.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/key/af_key.c b/net/key/af_key.c > index 2bdbcec781cd..a815f5ab4c49 100644 > --- a/net/key/af_key.c > +++ b/net/key/af_key.c > @@ -1261,7 +1261,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, > const struct sadb_x_nat_t_type* n_type; > struct xfrm_encap_tmpl *natt; > > - x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL); > + x->encap = kzalloc(sizeof(*x->encap), GFP_KERNEL); > if (!x->encap) { > err = -ENOMEM; > goto out; > -- > 2.25.1 >
Hello: This patch was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Thu, 9 Feb 2023 01:16:48 -0800 you wrote: > Since x->encap of pfkey_msg2xfrm_state() is not > initialized to 0, kernel heap data can be leaked. > > Fix with kzalloc() to prevent this. > > Signed-off-by: Hyunwoo Kim <v4bel@theori.io> > Acked-by: Herbert Xu <herbert@gondor.apana.org.au> > > [...] Here is the summary with links: - [v2] af_key: Fix heap information leak https://git.kernel.org/netdev/net/c/2f4796518315 You are awesome, thank you!
diff --git a/net/key/af_key.c b/net/key/af_key.c index 2bdbcec781cd..a815f5ab4c49 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1261,7 +1261,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, const struct sadb_x_nat_t_type* n_type; struct xfrm_encap_tmpl *natt; - x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL); + x->encap = kzalloc(sizeof(*x->encap), GFP_KERNEL); if (!x->encap) { err = -ENOMEM; goto out;