Commit df6d02300f7c2fbd0fbe626d819c8e5237d72c62

Authored by Johannes Berg
Committed by John W. Linville
1 parent 7acc7c683a

wext: fix potential private ioctl memory content leak

When a driver doesn't fill the entire buffer, old
heap contents may remain, and if it also doesn't
update the length properly, this old heap content
will be copied back to userspace.

It is very unlikely that this happens in any of
the drivers using private ioctls since it would
show up as junk being reported by iwpriv, but it
seems better to be safe here, so use kzalloc.

Reported-by: Jeff Mahoney <jeffm@suse.com>
Cc: stable@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff

net/wireless/wext-priv.c
... ... @@ -152,7 +152,7 @@
152 152 } else if (!iwp->pointer)
153 153 return -EFAULT;
154 154  
155   - extra = kmalloc(extra_size, GFP_KERNEL);
  155 + extra = kzalloc(extra_size, GFP_KERNEL);
156 156 if (!extra)
157 157 return -ENOMEM;
158 158