commit b06f9d9f1a907dd03f203e2ce9e27e318c22ba01
author Jon Maloy <jon.maloy@ericsson.com> Thu Oct 18 17:38:29 2018 +0200
committer David S. Miller <davem@davemloft.net> Thu Oct 18 16:49:53 2018 -0700
tree cf28a0414f8274c894c184aa833bb38bbb0af7c2
parent b6168562c8ce2bd5a30e213021650422e08764dc

tipc: fix info leak from kernel tipc_event

We initialize a struct tipc_event allocated on the kernel stack to
zero to avert info leak to user space.

Reported-by: syzbot+057458894bc8cada4dee@syzkaller.appspotmail.com
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/tipc/group.c

diff --git a/net/tipc/group.c b/net/tipc/group.c
index e82f13c..06fee14 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -666,6 +666,7 @@
 	struct sk_buff *skb;
 	struct tipc_msg *hdr;
 
+	memset(&evt, 0, sizeof(evt));
 	evt.event = event;
 	evt.found_lower = m->instance;
 	evt.found_upper = m->instance;