lkml.org 
[lkml]   [2015]   [Jun]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.0 095/105] cfg80211: wext: clear sinfo struct before calling driver
    Date
    4.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johannes Berg <johannes.berg@intel.com>

    commit 9c5a18a31b321f120efda412281bb9f610f84aa0 upstream.

    Until recently, mac80211 overwrote all the statistics it could
    provide when getting called, but it now relies on the struct
    having been zeroed by the caller. This was always the case in
    nl80211, but wext used a static struct which could even cause
    values from one device leak to another.

    Using a static struct is OK (as even documented in a comment)
    since the whole usage of this function and its return value is
    always locked under RTNL. Not clearing the struct for calling
    the driver has always been wrong though, since drivers were
    free to only fill values they could report, so calling this
    for one device and then for another would always have leaked
    values from one to the other.

    Fix this by initializing the structure in question before the
    driver method call.

    This fixes https://bugzilla.kernel.org/show_bug.cgi?id=99691

    Reported-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
    Reported-by: Alexander Kaltsas <alexkaltsas@gmail.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/wireless/wext-compat.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/net/wireless/wext-compat.c
    +++ b/net/wireless/wext-compat.c
    @@ -1333,6 +1333,8 @@ static struct iw_statistics *cfg80211_wi
    memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
    wdev_unlock(wdev);

    + memset(&sinfo, 0, sizeof(sinfo));
    +
    if (rdev_get_station(rdev, dev, bssid, &sinfo))
    return NULL;


    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2015-06-19 23:01    [W:4.365 / U:0.256 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site