aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Rosenberg <drosenberg@vsecurity.com>2010-12-26 06:54:53 +0000
committerGreg Kroah-Hartman <gregkh@suse.de>2011-04-14 16:53:14 -0700
commitb5ee7ec47851f8f85c9b96f20abc17b605823edd (patch)
tree394cbfc4e9b1deca9b3089853aa4ad81d5aa5561
parent69273e33a6d22d73dd89e4a68d54a0af3bd0e460 (diff)
downloadlinux-linaro-stable-b5ee7ec47851f8f85c9b96f20abc17b605823edd.tar.gz
CAN: Use inode instead of kernel address for /proc file
commit 9f260e0efa4766e56d0ac14f1aeea6ee5eb8fe83 upstream. Since the socket address is just being used as a unique identifier, its inode number is an alternative that does not leak potentially sensitive information. CC-ing stable because MITRE has assigned CVE-2010-4565 to the issue. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: David S. Miller <davem@davemloft.net> Cc: Moritz Muehlenhoff <jmm@debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--net/can/bcm.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 03154d9b0331..3c03cb00b790 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -117,7 +117,7 @@ struct bcm_sock {
struct list_head tx_ops;
unsigned long dropped_usr_msgs;
struct proc_dir_entry *bcm_proc_read;
- char procname [20]; /* pointer printed in ASCII with \0 */
+ char procname [32]; /* inode number in decimal with \0 */
};
static inline struct bcm_sock *bcm_sk(const struct sock *sk)
@@ -1506,7 +1506,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
if (proc_dir) {
/* unique socket address as filename */
- sprintf(bo->procname, "%p", sock);
+ sprintf(bo->procname, "%lu", sock_i_ino(sk));
bo->bcm_proc_read = proc_create_data(bo->procname, 0644,
proc_dir,
&bcm_proc_fops, sk);