diff options
| author |   Weiming Shi <bestswngs@gmail.com> | 2026-05-20 00:57:38 -0700 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2026-05-21 08:16:12 -0700 |
| commit | bddc09212c24934643bd44fc794748d2bbb3b6cd (patch) | |
| tree | ebb2d3b6fd806f9ecfef464eabf539ade7a3a3f0 /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | qed: fix double free in qed_cxt_tables_alloc() (diff) | |
tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an
uninitialised on-stack struct sockaddr_storage to userspace via
ifr_hwaddr, but netif_get_mac_address() only writes sa_family and
dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.
Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a
macvtap chardev returns kernel .text and direct-map pointers, defeating
KASLR.
Initialise ss at declaration.
Fixes: 3b23a32a6321 ("net: fix dev_ifsioc_locked() race condition")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260520075736.3415676-3-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions