[PATCH] net: lapb: fix uninitialized stack frame fields in lapb_decode()
From: Hui Peng <hidden>
Date: 2026-09-19 21:36:42
Also in:
lkml
Subsystem:
networking [general], the rest, x.25 stack · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds, Martin Schiller
`lapb_decode()` populates a caller-allocated `struct lapb_frame frame`
on the stack of `lapb_data_input()`, but does not zero-initialize
`*frame`.
1. When `skb->data[0]` is not a valid LAPB address byte (`LAPB_ADDR_A`,
`LAPB_ADDR_B`, `LAPB_ADDR_C`, or `LAPB_ADDR_D`), `frame->cr` is left
uninitialized on the stack while `lapb_decode()` continues parsing
and copies `frame->cr` into `lapb->frmr_data.cr` via
`lapb_transmit_frmr()`, leaking 1 bit of kernel stack memory over the
network.
2. When decoding an unnumbered (`LAPB_U`) or illegal frame in
`LAPB_EXTENDED` mode, `frame->control[1]` is left uninitialized on
the stack and copied into the outgoing `FRMR` frame by
`lapb_transmit_frmr()`.
Zero-initialize `*frame` at the start of `lapb_decode()` and return `-1`
when `skb->data[0]` is not a valid LAPB address byte.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <redacted>
---
net/lapb/lapb_subr.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/net/lapb/lapb_subr.c b/net/lapb/lapb_subr.c
index 592a22d86a97..8150f3583f15 100644
--- a/net/lapb/lapb_subr.c
+++ b/net/lapb/lapb_subr.c@@ -106,6 +106,7 @@ int lapb_validate_nr(struct lapb_cb *lapb, unsigned short nr) int lapb_decode(struct lapb_cb *lapb, struct sk_buff *skb, struct lapb_frame *frame) { + memset(frame, 0, sizeof(*frame)); frame->type = LAPB_ILLEGAL; lapb_dbg(2, "(%p) S%d RX %3ph\n", lapb->dev, lapb->state, skb->data);
@@ -120,25 +121,33 @@ int lapb_decode(struct lapb_cb *lapb, struct sk_buff *skb, if (lapb->mode & LAPB_DCE) { if (skb->data[0] == LAPB_ADDR_D) frame->cr = LAPB_COMMAND; - if (skb->data[0] == LAPB_ADDR_C) + else if (skb->data[0] == LAPB_ADDR_C) frame->cr = LAPB_RESPONSE; + else + return -1; } else { if (skb->data[0] == LAPB_ADDR_C) frame->cr = LAPB_COMMAND; - if (skb->data[0] == LAPB_ADDR_D) + else if (skb->data[0] == LAPB_ADDR_D) frame->cr = LAPB_RESPONSE; + else + return -1; } } else { if (lapb->mode & LAPB_DCE) { if (skb->data[0] == LAPB_ADDR_B) frame->cr = LAPB_COMMAND; - if (skb->data[0] == LAPB_ADDR_A) + else if (skb->data[0] == LAPB_ADDR_A) frame->cr = LAPB_RESPONSE; + else + return -1; } else { if (skb->data[0] == LAPB_ADDR_A) frame->cr = LAPB_COMMAND; - if (skb->data[0] == LAPB_ADDR_B) + else if (skb->data[0] == LAPB_ADDR_B) frame->cr = LAPB_RESPONSE; + else + return -1; } }
--
2.55.0.1082.g2b9226bbc0-goog