diff options
| author | Peilin Ye <yepeilin.cs@gmail.com> | 2020-07-28 08:36:04 +0300 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2020-07-28 13:50:15 +0300 |
| commit | 3c4f850e8441ac8b3b6dbaa6107604c4199ef01f (patch) | |
| tree | e71a1c747f21c9b1da813dbca97c10c61fbe071f /net/xdp | |
| parent | f6dfbe31e8fa5cbd5bc89df9d7f0fa0af7e69981 (diff) | |
| download | linux-3c4f850e8441ac8b3b6dbaa6107604c4199ef01f.tar.xz | |
xdp: Prevent kernel-infoleak in xsk_getsockopt()
xsk_getsockopt() is copying uninitialized stack memory to userspace when
'extra_stats' is 'false'. Fix it. Doing '= {};' is sufficient since currently
'struct xdp_statistics' is defined as follows:
struct xdp_statistics {
__u64 rx_dropped;
__u64 rx_invalid_descs;
__u64 tx_invalid_descs;
__u64 rx_ring_full;
__u64 rx_fill_ring_empty_descs;
__u64 tx_ring_empty_descs;
};
When being copied to the userspace, 'stats' will not contain any uninitialized
'holes' between struct fields.
Fixes: 8aa5a33578e9 ("xsk: Add new statistics")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Björn Töpel <bjorn.topel@intel.com>
Acked-by: Song Liu <songliubraving@fb.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/bpf/20200728053604.404631-1-yepeilin.cs@gmail.com
Diffstat (limited to 'net/xdp')
| -rw-r--r-- | net/xdp/xsk.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index 2e94a7e94671..c3231620d210 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -840,7 +840,7 @@ static int xsk_getsockopt(struct socket *sock, int level, int optname, switch (optname) { case XDP_STATISTICS: { - struct xdp_statistics stats; + struct xdp_statistics stats = {}; bool extra_stats = true; size_t stats_size; |