linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] fix information leak in wireless extensions on 64-bit  platforms
@ 2007-03-23  9:06 Johannes Berg
  2007-03-23 13:42 ` Johannes Berg
  0 siblings, 1 reply; 18+ messages in thread
From: Johannes Berg @ 2007-03-23  9:06 UTC (permalink / raw)
  To: John W. Linville, stable; +Cc: linux-wireless, Jean Tourrilhes

Wireless extensions on 64-bit platforms leak information from the kernel
stack due to padding in structs that is copied. This affects any
wireless event stream including scan results and so hence is available
to unprivileged users.

This patch is a quick fix for this that simply zeroes out the padding in
the structs before copying them until Jean comes up with the promised
better fix, at which time he can revert this one along with his new
patch.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Cc: stable@kernel.org
Cc: linux-wireless@vger.kernel.org
Cc: Jean Tourrilhes <jt@hpl.hp.com>

---
 include/net/iw_handler.h |   20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

--- wireless-dev.orig/include/net/iw_handler.h	2007-03-17 20:19:45.369309540 +0100
+++ wireless-dev/include/net/iw_handler.h	2007-03-17 20:19:59.429309540 +0100
@@ -484,6 +484,9 @@ iwe_stream_add_event(char *	stream,		/* 
 		     struct iw_event *iwe,	/* Payload */
 		     int	event_len)	/* Real size of payload */
 {
+	/* clear padding */
+	memset((char*)iwe + 4, 0, IW_EV_LCP_LEN - 4);
+
 	/* Check if it's possible */
 	if(likely((stream + event_len) < ends)) {
 		iwe->len = event_len;
@@ -505,6 +508,10 @@ iwe_stream_add_point(char *	stream,		/* 
 		     char *	extra)		/* More payload */
 {
 	int	event_len = IW_EV_POINT_LEN + iwe->u.data.length;
+
+	/* clear padding */
+	memset((char*)iwe + 4, 0, IW_EV_LCP_LEN - 4);
+
 	/* Check if it's possible */
 	if(likely((stream + event_len) < ends)) {
 		iwe->len = event_len;
@@ -531,6 +538,9 @@ iwe_stream_add_value(char *	event,		/* E
 		     struct iw_event *iwe,	/* Payload */
 		     int	event_len)	/* Real size of payload */
 {
+	/* clear padding */
+	memset((char*)iwe + 4, 0, IW_EV_LCP_LEN - 4);
+
 	/* Don't duplicate LCP */
 	event_len -= IW_EV_LCP_LEN;
 
@@ -558,6 +568,9 @@ iwe_stream_check_add_event(char *	stream
 			   int		event_len,	/* Size of payload */
 			   int *	perr)		/* Error report */
 {
+	/* clear padding */
+	memset((char*)iwe + 4, 0, IW_EV_LCP_LEN - 4);
+
 	/* Check if it's possible, set error if not */
 	if(likely((stream + event_len) < ends)) {
 		iwe->len = event_len;
@@ -582,6 +595,10 @@ iwe_stream_check_add_point(char *	stream
 			   int *	perr)		/* Error report */
 {
 	int	event_len = IW_EV_POINT_LEN + iwe->u.data.length;
+
+	/* clear padding */
+	memset((char*)iwe + 4, 0, IW_EV_LCP_LEN - 4);
+
 	/* Check if it's possible */
 	if(likely((stream + event_len) < ends)) {
 		iwe->len = event_len;
@@ -611,6 +628,9 @@ iwe_stream_check_add_value(char *	event,
 			   int		event_len,	/* Size of payload */
 			   int *	perr)		/* Error report */
 {
+	/* clear padding */
+	memset((char*)iwe + 4, 0, IW_EV_LCP_LEN - 4);
+
 	/* Don't duplicate LCP */
 	event_len -= IW_EV_LCP_LEN;
 



^ permalink raw reply	[flat|nested] 18+ messages in thread
end of thread, other threads:[~2007-03-26 15:48 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-03-23  9:06 [PATCH] fix information leak in wireless extensions on 64-bit platforms Johannes Berg
2007-03-23 13:42 ` Johannes Berg
2007-03-23 15:42   ` John W. Linville
2007-03-23 16:24     ` Jean Tourrilhes
2007-03-23 15:48   ` Jean Tourrilhes
2007-03-23 15:56     ` Johannes Berg
2007-03-23 16:13       ` Jean Tourrilhes
2007-03-23 16:35         ` [stable] " Greg KH
2007-03-23 16:53         ` Michael Buesch
2007-03-23 17:57           ` Jean Tourrilhes
2007-03-23 19:36         ` [stable] " Chris Wright
2007-03-23 20:00           ` Jean Tourrilhes
2007-03-23 20:05             ` Johannes Berg
2007-03-23 20:27             ` Michael Buesch
2007-03-23 20:31               ` Johannes Berg
2007-03-23 20:51               ` Jean Tourrilhes
2007-03-24 16:50                 ` Michael Buesch
2007-03-26 15:45                   ` Jean Tourrilhes

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).