Thread (1 message) 1 message, 1 author, 2016-05-03

Re: [PATCH] fix infoleak in wireless

From: Greg Kroah-Hartman <hidden>
Date: 2016-05-03 21:34:06
Also in: linux-wireless, lkml

On Tue, May 03, 2016 at 05:11:07PM -0400, Kangjie Lu wrote:
quoted hunk
Opps, I did not notice the patch is not attached.

From 34a82a734388d07eb10f91770f86938e38f7575a Mon Sep 17 00:00:00 2001
From: Kangjie Lu <redacted>
Date: Tue, 3 May 2016 14:15:18 -0400
Subject: [PATCH] fix infoleak in wireless
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 6-bytes array “mac_addr” is not initialized in the dump_station
implementations of “drivers/staging/wilc1000/wilc_wfi_cfgoperations.c”
and “drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c”, so all 6
bytes may be leaked.

Signed-off-by: Kangjie Lu <redacted>
---
 net/wireless/nl80211.c | 1 +
 1 file changed, 1 insertion(+)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 056a730..2e92d14 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3905,6 +3905,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
 
  while (1) {
  memset(&sinfo, 0, sizeof(sinfo));
+ eth_zero_addr(mac_addr);
  err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
  mac_addr, &sinfo);
  if (err == -ENOENT)
Patch is corrupted :(

Why not fix up the staging drivers, they are the real problem here,
which is what I think the networking maintainers were telling you to do.

thanks,

greg k-h
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help