[PATCH] net: qrtr: fix kernel stack infoleak in qrtr_getname() and qrtr_ioctl()
From: Hui Peng <hidden>
Date: 2026-09-19 21:28:50
Also in:
linux-arm-msm, lkml
Subsystem:
networking [general], qualcomm ipc router (qrtr) driver, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Manivannan Sadhasivam, Linus Torvalds
struct sockaddr_qrtr contains a 2-byte alignment padding hole between
`sq_family` (u16) and `sq_node` (u32).
In qrtr_getname(), declaring `struct sockaddr_qrtr qaddr;` on the stack
and assigning `qaddr = ipc->peer` or `qaddr = ipc->us` can leave the
2-byte padding hole uninitialized when copying `qaddr` to userspace via
`memcpy(saddr, &qaddr, sizeof(qaddr))`. Similarly, in qrtr_ioctl()
(`SIOCGIFADDR`), writing the 12-byte `struct sockaddr_qrtr` into the
16-byte `ifr.ifr_addr` without clearing `ifr.ifr_addr` leaves both the
2-byte padding hole and the trailing 4 bytes of `ifr.ifr_addr`
uninitialized before `put_user_ifreq()`.
Zero-initialize `qaddr` in qrtr_getname() and `ifr.ifr_addr` in
qrtr_ioctl(), and copy the explicit struct members.
Fixes: bdabad3e363d ("net: Add Qualcomm IPC router")
Assisted-by: LLM
Signed-off-by: Hui Peng <redacted>
---
net/qrtr/af_qrtr.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index cae7af5b9229..8c14c0434b2b 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c@@ -1178,7 +1178,7 @@ static int qrtr_getname(struct socket *sock, struct sockaddr *saddr, int peer) { struct qrtr_sock *ipc = qrtr_sk(sock->sk); - struct sockaddr_qrtr qaddr; + struct sockaddr_qrtr qaddr = {}; struct sock *sk = sock->sk; lock_sock(sk);
@@ -1188,9 +1188,11 @@ static int qrtr_getname(struct socket *sock, struct sockaddr *saddr, return -ENOTCONN; } - qaddr = ipc->peer; + qaddr.sq_node = ipc->peer.sq_node; + qaddr.sq_port = ipc->peer.sq_port; } else { - qaddr = ipc->us; + qaddr.sq_node = ipc->us.sq_node; + qaddr.sq_port = ipc->us.sq_port; } release_sock(sk);
@@ -1233,8 +1235,11 @@ static int qrtr_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) break; } + memset(&ifr.ifr_addr, 0, sizeof(ifr.ifr_addr)); sq = (struct sockaddr_qrtr *)&ifr.ifr_addr; - *sq = ipc->us; + sq->sq_family = ipc->us.sq_family; + sq->sq_node = ipc->us.sq_node; + sq->sq_port = ipc->us.sq_port; if (put_user_ifreq(&ifr, argp)) { rc = -EFAULT; break;
--
2.55.0.1082.g2b9226bbc0-goog