Yizhou Zhao 2cdeaba5a1 appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak ...

aarp_alloc() allocates struct aarp_entry without zeroing it, but only
initializes refcnt and packet_queue.  When an unresolved AARP entry is
created, hwaddr[ETH_ALEN] is left uninitialized.

aarp_seq_show() later prints this field with %pM when users read
/proc/net/atalk/arp.  This can expose 6 bytes of stale heap data for
each unresolved entry.

Fix this by zero-initializing struct aarp_entry at allocation time.

Reported-by: Yizhou Zhao <[email protected]>
Reported-by: Yuxiang Yang <[email protected]>
Reported-by: Ao Wang <[email protected]>
Reported-by: Xuewei Feng <[email protected]>
Reported-by: Qi Li <[email protected]>
Reported-by: Ke Xu <[email protected]>
Signed-off-by: Yizhou Zhao <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

2026-06-03 18:08:58 -07:00

..

aarp.c

appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak

2026-06-03 18:08:58 -07:00

atalk_proc.c

…

ddp.c

…

Kconfig

…

Makefile

…

sysctl_net_atalk.c

…