Messages in this thread | | | Subject | Re: [PATCH] wireless: fix 64K kernel heap content leak via ioctl | From | Johannes Berg <> | Date | Mon, 30 Aug 2010 19:50:02 +0200 |
| |
On Mon, 2010-08-30 at 10:40 -0700, Jean Tourrilhes wrote:
> Ha ! I see. It would be for regular iwpoint queries, not for > extended NOMAX queries (scan is a extended NOMAX query).
Yeah, that took a while to sink in here too ..
> I actually like your patch better than mine, it's closer to > the original intent of the API. Go for it ;-)
> Thanks a lot for the second pair of eyes.
And thank you for looking over my patch. I guess the real bug is still in cfg80211 there.
Initially I considered setting iwp->length to zero, rather than max_tokens. What do you think about doing that? The reason I decided to use max_tokens was that somebody might look at the length value to know how much to copy (which is OK only in NOMAX queries); but that would be a more severe driver bug ... can't really make up my mind. We just copy back zeroes anyway.
johannes
| |