rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3222
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/atm/common.c
Commit message: atm: update msg_namelen in vcc_recvmsg()

The current code does not fill the msg_name member in case it is set.
It also does not set the msg_namelen member to 0 and therefore makes
net/socket.c leak the local, uninitialized sockaddr_storage variable
to userland -- 128 bytes of kernel stack memory.

Fix that by simply setting msg_namelen to 0 as obviously nobody cared
about vcc_recvmsg() not filling the msg_name in case it was set.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, 	struct sk_buff *skb; 	int copied, error = -EINVAL;  	if (sock->state != SS_CONNECTED) 		return -ENOTCONN; 

Fixed version (after fix):
 int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, 	struct sk_buff *skb; 	int copied, error = -EINVAL;  	msg->msg_namelen = 0;  	if (sock->state != SS_CONNECTED) 		return -ENOTCONN; 

Patch:
patch: @@ -531,6 +531,8 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
 	struct sk_buff *skb;
 	int copied, error = -EINVAL;
 
+	msg->msg_namelen = 0;
+
 	if (sock->state != SS_CONNECTED)
 		return -ENOTCONN;
path: net/atm/common.c
Vulnerability: The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3223
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/ax25/af_ax25.c
Commit message: ax25: fix info leak via msg_name in ax25_recvmsg()

When msg_namelen is non-zero the sockaddr info gets filled out, as
requested, but the code fails to initialize the padding bytes of struct
sockaddr_ax25 inserted by the compiler for alignment. Additionally the
msg_namelen value is updated to sizeof(struct full_sockaddr_ax25) but is
not always filled up to this size.

Both issues lead to the fact that the code will leak uninitialized
kernel stack bytes in net/socket.c.

Fix both issues by initializing the memory with memset(0).

Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock, 		ax25_address src; 		const unsigned char *mac = skb_mac_header(skb);  		ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL, 				&digi, NULL, NULL); 		sax->sax25_family = AF_AX25;

Fixed version (after fix):
 static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock, 		ax25_address src; 		const unsigned char *mac = skb_mac_header(skb);  		memset(sax, 0, sizeof(struct full_sockaddr_ax25)); 		ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL, 				&digi, NULL, NULL); 		sax->sax25_family = AF_AX25;

Patch:
patch: @@ -1642,6 +1642,7 @@ static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
 		ax25_address src;
 		const unsigned char *mac = skb_mac_header(skb);
 
+		memset(sax, 0, sizeof(struct full_sockaddr_ax25));
 		ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
 				&digi, NULL, NULL);
 		sax->sax25_family = AF_AX25;
path: net/ax25/af_ax25.c
Vulnerability: The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3224
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/bluetooth/af_bluetooth.c
Commit message: Bluetooth: fix possible info leak in bt_sock_recvmsg()

In case the socket is already shutting down, bt_sock_recvmsg() returns
with 0 without updating msg_namelen leading to net/socket.c leaking the
local, uninitialized sockaddr_storage variable to userland -- 128 bytes
of kernel stack memory.

Fix this by moving the msg_namelen assignment in front of the shutdown
test.

Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 	if (flags & (MSG_OOB)) 		return -EOPNOTSUPP;  	skb = skb_recv_datagram(sk, flags, noblock, &err); 	if (!skb) { 		if (sk->sk_shutdown & RCV_SHUTDOWN) 			return 0; 		return err; 	}  	msg->msg_namelen = 0;  	copied = skb->len; 	if (len < copied) { 		msg->msg_flags |= MSG_TRUNC;

Fixed version (after fix):
 int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 	if (flags & (MSG_OOB)) 		return -EOPNOTSUPP;  	msg->msg_namelen = 0;  	skb = skb_recv_datagram(sk, flags, noblock, &err); 	if (!skb) { 		if (sk->sk_shutdown & RCV_SHUTDOWN) 			return 0; 		return err; 	}  	copied = skb->len; 	if (len < copied) { 		msg->msg_flags |= MSG_TRUNC;

Patch:
patch: @@ -230,15 +230,15 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 	if (flags & (MSG_OOB))
 		return -EOPNOTSUPP;
 
+	msg->msg_namelen = 0;
+
 	skb = skb_recv_datagram(sk, flags, noblock, &err);
 	if (!skb) {
 		if (sk->sk_shutdown & RCV_SHUTDOWN)
 			return 0;
 		return err;
 	}
 
-	msg->msg_namelen = 0;
-
 	copied = skb->len;
 	if (len < copied) {
 		msg->msg_flags |= MSG_TRUNC;
path: net/bluetooth/af_bluetooth.c
Vulnerability: The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3225
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/bluetooth/rfcomm/sock.c
Commit message: Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg()

If RFCOMM_DEFER_SETUP is set in the flags, rfcomm_sock_recvmsg() returns
early with 0 without updating the possibly set msg_namelen member. This,
in turn, leads to a 128 byte kernel stack leak in net/socket.c.

Fix this by updating msg_namelen in this case. For all other cases it
will be handled in bt_sock_stream_recvmsg().

Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,  	if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 		rfcomm_dlc_accept(d); 		return 0; 	} 

Fixed version (after fix):
 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,  	if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 		rfcomm_dlc_accept(d); 		msg->msg_namelen = 0; 		return 0; 	} 

Patch:
patch: @@ -608,6 +608,7 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
 	if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 		rfcomm_dlc_accept(d);
+		msg->msg_namelen = 0;
 		return 0;
 	}
path: net/bluetooth/rfcomm/sock.c
Vulnerability: The sco_sock_recvmsg function in net/bluetooth/sco.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3226
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/bluetooth/sco.c
Commit message: Bluetooth: SCO - Fix missing msg_namelen update in sco_sock_recvmsg()

If the socket is in state BT_CONNECT2 and BT_SK_DEFER_SETUP is set in
the flags, sco_sock_recvmsg() returns early with 0 without updating the
possibly set msg_namelen member. This, in turn, leads to a 128 byte
kernel stack leak in net/socket.c.

Fix this by updating msg_namelen in this case. For all other cases it
will be handled in bt_sock_recvmsg().

Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 	    test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 		hci_conn_accept(pi->conn->hcon, 0); 		sk->sk_state = BT_CONFIG;  		release_sock(sk); 		return 0;

Fixed version (after fix):
 static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 	    test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 		hci_conn_accept(pi->conn->hcon, 0); 		sk->sk_state = BT_CONFIG; 		msg->msg_namelen = 0;  		release_sock(sk); 		return 0;

Patch:
patch: @@ -665,6 +665,7 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 	    test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
 		hci_conn_accept(pi->conn->hcon, 0);
 		sk->sk_state = BT_CONFIG;
+		msg->msg_namelen = 0;
 
 		release_sock(sk);
 		return 0;
path: net/bluetooth/sco.c
Vulnerability: The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3227
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/caif/caif_socket.c
Commit message: caif: Fix missing msg_namelen update in caif_seqpkt_recvmsg()

The current code does not fill the msg_name member in case it is set.
It also does not set the msg_namelen member to 0 and therefore makes
net/socket.c leak the local, uninitialized sockaddr_storage variable
to userland -- 128 bytes of kernel stack memory.

Fix that by simply setting msg_namelen to 0 as obviously nobody cared
about caif_seqpkt_recvmsg() not filling the msg_name in case it was
set.

Cc: Sjur Braendeland <sjur.brandeland@stericsson.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock, 	if (m->msg_flags&MSG_OOB) 		goto read_error;  	skb = skb_recv_datagram(sk, flags, 0 , &ret); 	if (!skb) 		goto read_error;

Fixed version (after fix):
 static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock, 	if (m->msg_flags&MSG_OOB) 		goto read_error;  	m->msg_namelen = 0;  	skb = skb_recv_datagram(sk, flags, 0 , &ret); 	if (!skb) 		goto read_error;

Patch:
patch: @@ -286,6 +286,8 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
 	if (m->msg_flags&MSG_OOB)
 		goto read_error;
 
+	m->msg_namelen = 0;
+
 	skb = skb_recv_datagram(sk, flags, 0 , &ret);
 	if (!skb)
 		goto read_error;
path: net/caif/caif_socket.c
Vulnerability: The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3228
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/irda/af_irda.c
Commit message: irda: Fix missing msg_namelen update in irda_recvmsg_dgram()

The current code does not fill the msg_name member in case it is set.
It also does not set the msg_namelen member to 0 and therefore makes
net/socket.c leak the local, uninitialized sockaddr_storage variable
to userland -- 128 bytes of kernel stack memory.

Fix that by simply setting msg_namelen to 0 as obviously nobody cared
about irda_recvmsg_dgram() not filling the msg_name in case it was
set.

Cc: Samuel Ortiz <samuel@sortiz.org>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,  	IRDA_DEBUG(4, "%s()\n", __func__);  	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 				flags & MSG_DONTWAIT, &err); 	if (!skb)

Fixed version (after fix):
 static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,  	IRDA_DEBUG(4, "%s()\n", __func__);  	msg->msg_namelen = 0;  	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 				flags & MSG_DONTWAIT, &err); 	if (!skb)

Patch:
patch: @@ -1386,6 +1386,8 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
 
 	IRDA_DEBUG(4, "%s()\n", __func__);
 
+	msg->msg_namelen = 0;
+
 	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
 				flags & MSG_DONTWAIT, &err);
 	if (!skb)
path: net/irda/af_irda.c
Vulnerability: The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3229
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/iucv/af_iucv.c
Commit message: iucv: Fix missing msg_namelen update in iucv_sock_recvmsg()

The current code does not fill the msg_name member in case it is set.
It also does not set the msg_namelen member to 0 and therefore makes
net/socket.c leak the local, uninitialized sockaddr_storage variable
to userland -- 128 bytes of kernel stack memory.

Fix that by simply setting msg_namelen to 0 as obviously nobody cared
about iucv_sock_recvmsg() not filling the msg_name in case it was set.

Cc: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 	struct sk_buff *skb, *rskb, *cskb; 	int err = 0;  	if ((sk->sk_state == IUCV_DISCONN) && 	    skb_queue_empty(&iucv->backlog_skb_q) && 	    skb_queue_empty(&sk->sk_receive_queue) &&

Fixed version (after fix):
 static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 	struct sk_buff *skb, *rskb, *cskb; 	int err = 0;  	msg->msg_namelen = 0;  	if ((sk->sk_state == IUCV_DISCONN) && 	    skb_queue_empty(&iucv->backlog_skb_q) && 	    skb_queue_empty(&sk->sk_receive_queue) &&

Patch:
patch: @@ -1328,6 +1328,8 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 	struct sk_buff *skb, *rskb, *cskb;
 	int err = 0;
 
+	msg->msg_namelen = 0;
+
 	if ((sk->sk_state == IUCV_DISCONN) &&
 	    skb_queue_empty(&iucv->backlog_skb_q) &&
 	    skb_queue_empty(&sk->sk_receive_queue) &&
path: net/iucv/af_iucv.c
Vulnerability: The l2tp_ip6_recvmsg function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.9-rc7 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3230
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/l2tp/l2tp_ip6.c
Commit message: l2tp: fix info leak in l2tp_ip6_recvmsg()

The L2TP code for IPv6 fails to initialize the l2tp_conn_id member of
struct sockaddr_l2tpip6 and therefore leaks four bytes kernel stack
in l2tp_ip6_recvmsg() in case msg_name is set.

Initialize l2tp_conn_id with 0 to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk, 		lsa->l2tp_addr = ipv6_hdr(skb)->saddr; 		lsa->l2tp_flowinfo = 0; 		lsa->l2tp_scope_id = 0; 		if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL) 			lsa->l2tp_scope_id = IP6CB(skb)->iif; 	}

Fixed version (after fix):
 static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk, 		lsa->l2tp_addr = ipv6_hdr(skb)->saddr; 		lsa->l2tp_flowinfo = 0; 		lsa->l2tp_scope_id = 0; 		lsa->l2tp_conn_id = 0; 		if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL) 			lsa->l2tp_scope_id = IP6CB(skb)->iif; 	}

Patch:
patch: @@ -690,6 +690,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
 		lsa->l2tp_addr = ipv6_hdr(skb)->saddr;
 		lsa->l2tp_flowinfo = 0;
 		lsa->l2tp_scope_id = 0;
+		lsa->l2tp_conn_id = 0;
 		if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL)
 			lsa->l2tp_scope_id = IP6CB(skb)->iif;
 	}
path: net/l2tp/l2tp_ip6.c
Vulnerability: The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3231
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/llc/af_llc.c
Commit message: llc: Fix missing msg_namelen update in llc_ui_recvmsg()

For stream sockets the code misses to update the msg_namelen member
to 0 and therefore makes net/socket.c leak the local, uninitialized
sockaddr_storage variable to userland -- 128 bytes of kernel stack
memory. The msg_namelen update is also missing for datagram sockets
in case the socket is shutting down during receive.

Fix both issues by setting msg_namelen to 0 early. It will be
updated later if we're going to fill the msg_name member.

Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock, 	int target;	/* Read at least this many bytes */ 	long timeo;  	lock_sock(sk); 	copied = -ENOTCONN; 	if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))

Fixed version (after fix):
 static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock, 	int target;	/* Read at least this many bytes */ 	long timeo;  	msg->msg_namelen = 0;  	lock_sock(sk); 	copied = -ENOTCONN; 	if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))

Patch:
patch: @@ -720,6 +720,8 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
 	int target;	/* Read at least this many bytes */
 	long timeo;
 
+	msg->msg_namelen = 0;
+
 	lock_sock(sk);
 	copied = -ENOTCONN;
 	if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
path: net/llc/af_llc.c
Vulnerability: The llcp_sock_recvmsg function in net/nfc/llcp/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable and a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3233
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/nfc/llcp/sock.c
Commit message: NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg()

The code in llcp_sock_recvmsg() does not initialize all the members of
struct sockaddr_nfc_llcp when filling the sockaddr info. Nor does it
initialize the padding bytes of the structure inserted by the compiler
for alignment.

Also, if the socket is in state LLCP_CLOSED or is shutting down during
receive the msg_namelen member is not updated to 0 while otherwise
returning with 0, i.e. "success". The msg_namelen update is also
missing for stream and seqpacket sockets which don't fill the sockaddr
info.

Both issues lead to the fact that the code will leak uninitialized
kernel stack bytes in net/socket.c.

Fix the first issue by initializing the memory used for sockaddr info
with memset(0). Fix the second one by setting msg_namelen to 0 early.
It will be updated later if we're going to fill the msg_name member.

Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
Cc: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,  	pr_debug("%p %zu\n", sk, len);  	lock_sock(sk);  	if (sk->sk_state == LLCP_CLOSED && static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,  		pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);  		sockaddr->sa_family = AF_NFC; 		sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP; 		sockaddr->dsap = ui_cb->dsap;

Fixed version (after fix):
 static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,  	pr_debug("%p %zu\n", sk, len);  	msg->msg_namelen = 0;  	lock_sock(sk);  	if (sk->sk_state == LLCP_CLOSED && static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,  		pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);  		memset(sockaddr, 0, sizeof(*sockaddr)); 		sockaddr->sa_family = AF_NFC; 		sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP; 		sockaddr->dsap = ui_cb->dsap;

Patch:
patch: @@ -646,6 +646,8 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
 	pr_debug("%p %zu\n", sk, len);
 
+	msg->msg_namelen = 0;
+
 	lock_sock(sk);
 
 	if (sk->sk_state == LLCP_CLOSED &&
@@ -691,6 +693,7 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
 		pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
 
+		memset(sockaddr, 0, sizeof(*sockaddr));
 		sockaddr->sa_family = AF_NFC;
 		sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP;
 		sockaddr->dsap = ui_cb->dsap;
path: net/nfc/llcp/sock.c