From: Clément Lecigne <clement.lecigne@netasq.com>
Date: Fri, 13 Feb 2009 00:59:09 +0000 (-0800)
Subject: net: 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2
X-Git-Tag: v2.6.27.18~26
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bb450c36212e670fdb0cf58fd453557c243f515f;p=pandora-kernel.git

net: 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2

[ Upstream commit df0bca049d01c0ee94afb7cd5dfd959541e6c8da ]

In function sock_getsockopt() located in net/core/sock.c, optval v.val
is not correctly initialized and directly returned in userland in case
we have SO_BSDCOMPAT option set.

This dummy code should trigger the bug:

int main(void)
{
	unsigned char buf[4] = { 0, 0, 0, 0 };
	int len;
	int sock;
	sock = socket(33, 2, 2);
	getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
	printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
	close(sock);
}

Here is a patch that fix this bug by initalizing v.val just after its
declaration.

Signed-off-by: Clément Lecigne <clement.lecigne@netasq.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

Reading git-diff-tree failed