lkml.org 
[lkml]   [2010]   [Oct]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[055/103] wext: fix potential private ioctl memory content leak
    2.6.35-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Johannes Berg <johannes.berg@intel.com>

    commit df6d02300f7c2fbd0fbe626d819c8e5237d72c62 upstream.

    When a driver doesn't fill the entire buffer, old
    heap contents may remain, and if it also doesn't
    update the length properly, this old heap content
    will be copied back to userspace.

    It is very unlikely that this happens in any of
    the drivers using private ioctls since it would
    show up as junk being reported by iwpriv, but it
    seems better to be safe here, so use kzalloc.

    Reported-by: Jeff Mahoney <jeffm@suse.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/wireless/wext-priv.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/wireless/wext-priv.c
    +++ b/net/wireless/wext-priv.c
    @@ -152,7 +152,7 @@ static int ioctl_private_iw_point(struct
    } else if (!iwp->pointer)
    return -EFAULT;

    - extra = kmalloc(extra_size, GFP_KERNEL);
    + extra = kzalloc(extra_size, GFP_KERNEL);
    if (!extra)
    return -ENOMEM;




    \
     
     \ /
      Last update: 2010-10-22 21:11    [W:0.018 / U:0.604 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site