Mathias Krause 9b3e617f3d atm: update msg_namelen in vcc_recvmsg() ...

The current code does not fill the msg_name member in case it is set.
It also does not set the msg_namelen member to 0 and therefore makes
net/socket.c leak the local, uninitialized sockaddr_storage variable
to userland -- 128 bytes of kernel stack memory.

Fix that by simply setting msg_namelen to 0 as obviously nobody cared
about vcc_recvmsg() not filling the msg_name in case it was set.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2013-04-07 16:28:00 -04:00

..

addr.c

…

addr.h

…

atm_misc.c

…

atm_sysfs.c

atm: use scnprintf() instead of sprintf()

2012-12-17 20:50:51 -08:00

br2684.c

br2684: allow assign only on a connected socket

2012-12-02 00:05:19 +00:00

clip.c

…

common.c

atm: update msg_namelen in vcc_recvmsg()

2013-04-07 16:28:00 -04:00

common.h

…

ioctl.c

…

Kconfig

…

lec_arpc.h

…

lec.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

lec.h

…

Makefile

…

mpc.c

…

mpc.h

…

mpoa_caches.c

…

mpoa_caches.h

…

mpoa_proc.c

…

pppoatm.c

pppoatm: optimise PPP channel wakeups after sock_owned_by_user()

2012-12-02 00:05:20 +00:00

proc.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-02-26 20:16:07 -08:00

protocols.h

…

pvc.c

…

raw.c

…

resources.c

…

resources.h

…

signaling.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

signaling.h

…

svc.c

…