`lapb_decode()` populates a caller-allocated `struct lapb_frame frame` on the stack of `lapb_data_input()`, but does not zero-initialize `*frame`. 1. When `skb->data[0]` is not a valid LAPB address byte (`LAPB_ADDR_A`, `LAPB_ADDR_B`, `LAPB_ADDR_C`, or `LAPB_ADDR_D`), `frame->cr` is left uninitialized on the stack while `lapb_decode()` continues parsing and copies `frame->cr` into `lapb->frmr_data.cr` via `lapb_transmit_frmr()`, leaking 1 bit of kernel stack memory over the network. 2. When decoding an unnumbered (`LAPB_U`) or illegal frame in `LAPB_EXTENDED` mode, `frame->control[1]` is left uninitialized on the stack and copied into the outgoing `FRMR` frame by `lapb_transmit_frmr()`. Zero-initialize `*frame` at the start of `lapb_decode()` and return `-1` when `skb->data[0]` is not a valid LAPB address byte. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: LLM Signed-off-by: Hui Peng --- net/lapb/lapb_subr.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/net/lapb/lapb_subr.c b/net/lapb/lapb_subr.c index 592a22d86a97..8150f3583f15 100644 --- a/net/lapb/lapb_subr.c +++ b/net/lapb/lapb_subr.c @@ -106,6 +106,7 @@ int lapb_validate_nr(struct lapb_cb *lapb, unsigned short nr) int lapb_decode(struct lapb_cb *lapb, struct sk_buff *skb, struct lapb_frame *frame) { + memset(frame, 0, sizeof(*frame)); frame->type = LAPB_ILLEGAL; lapb_dbg(2, "(%p) S%d RX %3ph\n", lapb->dev, lapb->state, skb->data); @@ -120,25 +121,33 @@ int lapb_decode(struct lapb_cb *lapb, struct sk_buff *skb, if (lapb->mode & LAPB_DCE) { if (skb->data[0] == LAPB_ADDR_D) frame->cr = LAPB_COMMAND; - if (skb->data[0] == LAPB_ADDR_C) + else if (skb->data[0] == LAPB_ADDR_C) frame->cr = LAPB_RESPONSE; + else + return -1; } else { if (skb->data[0] == LAPB_ADDR_C) frame->cr = LAPB_COMMAND; - if (skb->data[0] == LAPB_ADDR_D) + else if (skb->data[0] == LAPB_ADDR_D) frame->cr = LAPB_RESPONSE; + else + return -1; } } else { if (lapb->mode & LAPB_DCE) { if (skb->data[0] == LAPB_ADDR_B) frame->cr = LAPB_COMMAND; - if (skb->data[0] == LAPB_ADDR_A) + else if (skb->data[0] == LAPB_ADDR_A) frame->cr = LAPB_RESPONSE; + else + return -1; } else { if (skb->data[0] == LAPB_ADDR_A) frame->cr = LAPB_COMMAND; - if (skb->data[0] == LAPB_ADDR_B) + else if (skb->data[0] == LAPB_ADDR_B) frame->cr = LAPB_RESPONSE; + else + return -1; } } -- 2.55.0.1082.g2b9226bbc0-goog