[PATCH] net: qrtr: fix kernel stack infoleak in qrtr_getname() and qrtr_ioctl()

[PATCH] net: qrtr: fix kernel stack infoleak in qrtr_getname() and qrtr_ioctl()

[Hui Peng]

struct sockaddr_qrtr contains a 2-byte alignment padding hole between
`sq_family` (u16) and `sq_node` (u32).

In qrtr_getname(), declaring `struct sockaddr_qrtr qaddr;` on the stack
and assigning `qaddr = ipc->peer` or `qaddr = ipc->us` can leave the
2-byte padding hole uninitialized when copying `qaddr` to userspace via
`memcpy(saddr, &qaddr, sizeof(qaddr))`. Similarly, in qrtr_ioctl()
(`SIOCGIFADDR`), writing the 12-byte `struct sockaddr_qrtr` into the
16-byte `ifr.ifr_addr` without clearing `ifr.ifr_addr` leaves both the
2-byte padding hole and the trailing 4 bytes of `ifr.ifr_addr`
uninitialized before `put_user_ifreq()`.

Zero-initialize `qaddr` in qrtr_getname() and `ifr.ifr_addr` in
qrtr_ioctl(), and copy the explicit struct members.

Fixes: bdabad3e363d ("net: Add Qualcomm IPC router")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/qrtr/af_qrtr.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index cae7af5b9229..8c14c0434b2b 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -1178,7 +1178,7 @@ static int qrtr_getname(struct socket *sock, struct sockaddr *saddr,
 			int peer)
 {
 	struct qrtr_sock *ipc = qrtr_sk(sock->sk);
-	struct sockaddr_qrtr qaddr;
+	struct sockaddr_qrtr qaddr = {};
 	struct sock *sk = sock->sk;
 
 	lock_sock(sk);
@@ -1188,9 +1188,11 @@ static int qrtr_getname(struct socket *sock, struct sockaddr *saddr,
 			return -ENOTCONN;
 		}
 
-		qaddr = ipc->peer;
+		qaddr.sq_node = ipc->peer.sq_node;
+		qaddr.sq_port = ipc->peer.sq_port;
 	} else {
-		qaddr = ipc->us;
+		qaddr.sq_node = ipc->us.sq_node;
+		qaddr.sq_port = ipc->us.sq_port;
 	}
 	release_sock(sk);
 
@@ -1233,8 +1235,11 @@ static int qrtr_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 			break;
 		}
 
+		memset(&ifr.ifr_addr, 0, sizeof(ifr.ifr_addr));
 		sq = (struct sockaddr_qrtr *)&ifr.ifr_addr;
-		*sq = ipc->us;
+		sq->sq_family = ipc->us.sq_family;
+		sq->sq_node = ipc->us.sq_node;
+		sq->sq_port = ipc->us.sq_port;
 		if (put_user_ifreq(&ifr, argp)) {
 			rc = -EFAULT;
 			break;
-- 
2.55.0.1082.g2b9226bbc0-goog