Piteball
/
android_kernel_samsung_msm8226
mirror of https://github.com/S3NEO/android_kernel_samsung_msm8226.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

net: ipc_router: Initialize the sockaddr in recvmsg() handler 

sockaddr structure is filled with required information only which
results in few memory locations of structure with uninitialized data.

Memset complete structure before using it to remove uninitialized data.

CRs-Fixed: 2274853
Change-Id: I181710bde100fb1553b925d9fdf227af35ff38b5
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
[haggertk: Backport to 3.4/msm8974]
CVE-2018-12011
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
Arun Kumar Neelakantam 2018-07-19 14:25:22 +05:30 committed by Francescodario Cuzzocrea
parent 51ced334d4
commit 3c81f1cf59
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
arch/arm/mach-msm/ipc_socket.c
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2011-2014, 2016, The Linux Foundation. All rights reserved.
/* Copyright (c) 2011-2014, 2016, 2018, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -224,6 +224,7 @@ static int msm_ipc_router_extract_msg(struct msghdr *m,
if (addr && (hdr->type == IPC_ROUTER_CTRL_CMD_RESUME_TX)) {
temp = skb_peek(pkt->pkt_fragment_q);
ctl_msg = (union rr_control_msg *)(temp->data);
memset(addr, 0x0, sizeof(*addr));
addr->family = AF_MSM_IPC;
addr->address.addrtype = MSM_IPC_ADDR_ID;
addr->address.addr.port_addr.node_id = ctl_msg->cli.node_id;
@ -232,6 +233,7 @@ static int msm_ipc_router_extract_msg(struct msghdr *m,
return offset;
}
if (addr && (hdr->type == IPC_ROUTER_CTRL_CMD_DATA)) {
memset(addr, 0x0, sizeof(*addr));
addr->family = AF_MSM_IPC;
addr->address.addrtype = MSM_IPC_ADDR_ID;
addr->address.addr.port_addr.node_id = hdr->src_node_id;