Commit 21cbf883 authored by Eric Dumazet's avatar Eric Dumazet Committed by Johannes Berg
Browse files

wifi: avoid kernel-infoleak from struct iw_point 



struct iw_point has a 32bit hole on 64bit arches.

struct iw_point {
  void __user   *pointer;       /* Pointer to the data  (in user space) */
  __u16         length;         /* number of fields or size in bytes */
  __u16         flags;          /* Optional params */
};

Make sure to zero the structure to avoid disclosing 32bits of kernel data
to user space.

Fixes: 87de87d5 ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c")
Reported-by: default avatar <syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u


Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent dbf8fe85

net/wireless/wext-core.c

+4 −0
Original line number Diff line number Diff line
@@ -1101,6 +1101,10 @@ static int compat_standard_call(struct net_device *dev, 
		return ioctl_standard_call(dev, iwr, cmd, info, handler);



	iwp_compat = (struct compat_iw_point *) &iwr->u.data;



	/* struct iw_point has a 32bit hole on 64bit arches. */

	memset(&iwp, 0, sizeof(iwp));



	iwp.pointer = compat_ptr(iwp_compat->pointer);

	iwp.length = iwp_compat->length;

	iwp.flags = iwp_compat->flags;

net/wireless/wext-priv.c

+4 −0
Original line number Diff line number Diff line
@@ -228,6 +228,10 @@ int compat_private_call(struct net_device *dev, struct iwreq *iwr, 
		struct iw_point iwp;



		iwp_compat = (struct compat_iw_point *) &iwr->u.data;



		/* struct iw_point has a 32bit hole on 64bit arches. */

		memset(&iwp, 0, sizeof(iwp));



		iwp.pointer = compat_ptr(iwp_compat->pointer);

		iwp.length = iwp_compat->length;

		iwp.flags = iwp_compat->flags;