summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2010-09-17 00:38:25 +0200
committerGreg Kroah-Hartman <gregkh@suse.de>2010-10-28 21:44:02 -0700
commitb381cabc483913da8a3e591885f9008c9efddd21 (patch)
tree8bc80950d5f370cb7271abf6ed30bcbf56167edd /net
parent9921a24c5d59ca4e16364d9973b90a68e6642732 (diff)
wext: fix potential private ioctl memory content leak
commit df6d02300f7c2fbd0fbe626d819c8e5237d72c62 upstream. When a driver doesn't fill the entire buffer, old heap contents may remain, and if it also doesn't update the length properly, this old heap content will be copied back to userspace. It is very unlikely that this happens in any of the drivers using private ioctls since it would show up as junk being reported by iwpriv, but it seems better to be safe here, so use kzalloc. Reported-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net')
-rw-r--r--net/wireless/wext.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index fddcf9c11050..a2e4c60ac239 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -1029,7 +1029,7 @@ static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
} else if (!iwp->pointer)
return -EFAULT;
- extra = kmalloc(extra_size, GFP_KERNEL);
+ extra = kzalloc(extra_size, GFP_KERNEL);
if (!extra)
return -ENOMEM;