Mathias Krause 5fe0d4bd8f xfrm_user: fix info leak in copy_user_offload() ...

The memory reserved to dump the xfrm offload state includes padding
bytes of struct xfrm_user_offload added by the compiler for alignment.
Add an explicit memset(0) before filling the buffer to avoid the heap
info leak.

Cc: Steffen Klassert <steffen.klassert@secunet.com>
Fixes: d77e38e612 ("xfrm: Add an IPsec hardware offloading API")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

2017-08-28 10:58:02 +02:00

..

Kconfig

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2017-02-16 21:25:49 -05:00

Makefile

xfrm: fix xfrm_dev_event() missing when compile without CONFIG_XFRM_OFFLOAD

2017-06-07 08:16:27 +02:00

xfrm_algo.c

xfrm: use IS_ENABLED() instead of checking for built-in or module

2016-09-10 21:19:11 -07:00

xfrm_device.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-06-30 12:43:08 -04:00

xfrm_hash.c

net: allow GFP_HIGHMEM in __vmalloc()

2010-11-21 10:04:04 -08:00

xfrm_hash.h

xfrm: use "unsigned int" in __xfrm6_pref_hash()

2017-03-24 07:03:12 +01:00

xfrm_input.c

net, xfrm: convert sec_path.refcnt from atomic_t to refcount_t

2017-07-04 22:35:18 +01:00

xfrm_ipcomp.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-11-04 13:48:30 -05:00

xfrm_output.c

xfrm: Add encapsulation header offsets while SKB is not encrypted

2017-04-14 10:07:39 +02:00

xfrm_policy.c

net: xfrm: don't double-hold dst when sk_policy in use.

2017-08-24 13:01:14 +02:00

xfrm_proc.c

proc: Reduce cache miss in xfrm_statistics_seq_show

2016-09-30 01:50:45 -04:00

xfrm_replay.c

xfrm: Add xfrm_replay_overflow functions for offloading

2017-04-14 10:07:01 +02:00

xfrm_state.c

xfrm: fix null pointer dereference on state and tmpl sort

2017-08-02 13:37:37 +02:00

xfrm_sysctl.c

net: xfrm: Change u32 sysctl entries to use proc_douintvec

2016-09-07 23:17:53 -07:00

xfrm_user.c

xfrm_user: fix info leak in copy_user_offload()

2017-08-28 10:58:02 +02:00