From: Dan Carpenter <[email protected]>
Date: Thu, 4 Apr 2024 17:24:23 +0300
> On Wed, Mar 27, 2024 at 04:23:52PM +0100, Alexander Lobakin wrote:
>> +bool ip_tunnel_parm_to_user(void __user *data, struct ip_tunnel_parm_kern
>> *kp)
>> +{
>> + struct ip_tunnel_parm p;
>> +
>> + strscpy(p.name, kp->name);
>
> We need to clear out p before copying to user space to avoid an
> information leak. So this strscpy() needs to be strcpy_pad()
>
>> + p.link = kp->link;
>> + p.i_flags = kp->i_flags;
>> + p.o_flags = kp->o_flags;
>> + p.i_key = kp->i_key;
>> + p.o_key = kp->o_key;
>> + memcpy(&p.iph, &kp->iph, min(sizeof(p.iph), sizeof(kp->iph)));
>
> And this memcpy() doesn't necessarily clear the whole of p.iph.
Oh, let me send a follow-up covering all this.
>
>> +
>> + return !copy_to_user(data, &p, sizeof(p));
>> +}
>
> regards,
> dan carpenter
Thanks!
Olek
