summaryrefslogtreecommitdiff
path: root/net/wireless/wext-compat.c
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2010-08-30 14:24:54 +0400
committerJohn W. Linville <linville@tuxdriver.com>2010-08-31 00:35:17 +0400
commit42da2f948d949efd0111309f5827bf0298bcc9a4 (patch)
tree9bcf654ba27e198935a00e679c91181365ee37fa /net/wireless/wext-compat.c
parent9ef808048564928a83f3a52c65c5725688cf5cbe (diff)
downloadlinux-42da2f948d949efd0111309f5827bf0298bcc9a4.tar.xz
wireless extensions: fix kernel heap content leak
Wireless extensions have an unfortunate, undocumented requirement which requires drivers to always fill iwp->length when returning a successful status. When a driver doesn't do this, it leads to a kernel heap content leak when userspace offers a larger buffer than would have been necessary. Arguably, this is a driver bug, as it should, if it returns 0, fill iwp->length, even if it separately indicated that the buffer contents was not valid. However, we can also at least avoid the memory content leak if the driver doesn't do this by setting the iwp length to max_tokens, which then reflects how big the buffer is that the driver may fill, regardless of how big the userspace buffer is. To illustrate the point, this patch also fixes a corresponding cfg80211 bug (since this requirement isn't documented nor was ever pointed out by anyone during code review, I don't trust all drivers nor all cfg80211 handlers to implement it correctly). Cc: stable@kernel.org [all the way back] Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/wireless/wext-compat.c')
-rw-r--r--net/wireless/wext-compat.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index bb5e0a5ecfa1..7e5c3a45f811 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -1420,6 +1420,9 @@ int cfg80211_wext_giwessid(struct net_device *dev,
{
struct wireless_dev *wdev = dev->ieee80211_ptr;
+ data->flags = 0;
+ data->length = 0;
+
switch (wdev->iftype) {
case NL80211_IFTYPE_ADHOC:
return cfg80211_ibss_wext_giwessid(dev, info, data, ssid);