The following commit has been merged in the batman-adv/next branch: commit 5ef5d6c569f80cf716d75fa88e9b5ee72f0986b2 Author: Dan Carpenter dan.carpenter@oracle.com Date: Thu Aug 16 03:14:04 2012 +0000
gre: information leak in ip6_tnl_ioctl()
There is a one byte hole between p->hop_limit and p->flowinfo where stack memory is leaked to the user. This was introduced in c12b395a46 "gre: Support GRE over IPv6".
Signed-off-by: Dan Carpenter dan.carpenter@oracle.com
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 33d2a0e..cb7e2de 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1312,6 +1312,8 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) } ip6_tnl_parm_from_user(&p1, &p); t = ip6_tnl_locate(net, &p1, 0); + } else { + memset(&p, 0, sizeof(p)); } if (t == NULL) t = netdev_priv(dev);