Gerrit Renker 10d8dad845
wext: fix alignment problem in serializing 'struct iw_point' ...
wext: fix alignment problem in serializing 'struct iw_point'
This fixes a typo in the definition of the serialized length of struct iw_point:
a) wireless.h is exported to userspace, the typo causes IW_EV_POINT_PK_LEN
to be 12 on 64-bit, and 8 on 32-bit systems (causing misalignment);
b) in compat-64 mode iwe_stream_add_point() memcpys overlap (see below).
The second case in in compat-64 mode looks like (variable names are as in
include/net/iw_handler.h:iwe_stream_add_point()):
point_len = IW_EV_COMPAT_POINT_LEN = 8
lcp_len = IW_EV_COMPAT_LCP_LEN = 4
2nd memcpy: IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN = 12 - 4 = 8
IW_EV_LCP_PK_LEN
<--------------> *---> 'extra' data area
+-------+-------+-------+-------+---------------+------- ...-+
| len | cmd |length | flags | (empty) -> extra ... |
+-------+-------+-------+-------+---------------+------- ...-+
2 2 2 2 4
lcp_len
<--------------> <-!! OVERLAP !!>
<--1st memcpy--><------- 2nd memcpy ----------->
<---- 3rd memcpy ------- ... >
<--------- point_len ---------->
This case could cause overrun whenever iw_point.length < 4.
The other two cases are -
* 32-bit systems: IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN = 8 - 4 = 4,
the second memcpy copies exactly the 4 required bytes;
* 64-bit systems: IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN = 12 - 4 = 8,
the second memcpy copies a superfluous (but non overlapping) 4 bytes.
The patch changes IW_EV_POINT_PK_LEN to be 8, so that in all 3 cases always only
the requested iw_point.{length,flags} (both __u16) are copied, avoiding overrrun
(compat-64) and superfluous copy (64-bit). In addition, the userspace header is
sanitized (in agreement with version 30 of the wireless tools).
Many thanks to Johannes Berg for help and review with this patch.
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk >
Signed-off-by: John W. Linville <linville@tuxdriver.com >
2010-10-13 15:45:21 -04:00
2010-07-31 14:20:02 +01:00
2010-05-26 08:30:15 -07:00
2010-06-20 19:46:07 -07:00
2010-07-22 18:06:25 +02:00
2010-08-02 15:03:21 -03:00
2010-07-26 01:17:41 -07:00
2010-07-31 02:37:17 -07:00
2010-05-28 01:38:00 +02:00
2010-05-31 13:11:47 +09:00
2010-05-14 01:56:12 +01:00
2010-07-23 14:07:47 +02:00
2010-06-28 14:16:08 +02:00
2010-06-28 14:16:08 +02:00
2010-07-28 15:09:26 +01:00
2010-09-21 11:04:38 -04:00
2010-08-24 16:28:11 -04:00
2010-05-14 15:09:37 -04:00
2010-08-02 16:43:15 -03:00
2010-07-24 23:26:09 -04:00
2010-06-15 09:56:01 +10:00
2010-05-14 17:08:01 -04:00
2010-05-27 09:12:53 -07:00
2010-05-21 09:34:30 -07:00
2010-05-21 09:34:30 -07:00
2010-05-19 13:38:54 -04:00
2010-07-09 00:09:20 -07:00
2010-07-06 08:59:53 +02:00
2010-05-30 09:00:03 -07:00
2010-05-18 09:17:01 -07:00
2010-06-01 12:23:18 +02:00
2010-06-24 21:30:09 -07:00
2010-05-27 22:15:33 -04:00
2010-08-02 15:34:57 +10:00
2010-08-04 11:47:58 -07:00
2010-05-25 08:07:00 -07:00
2010-05-27 09:12:53 -07:00
2010-06-29 15:29:31 -07:00
2010-06-29 15:29:31 -07:00
2010-05-29 09:12:30 -07:00
2010-05-19 22:41:05 -04:00
2010-08-03 13:47:04 -04:00
2010-05-27 21:06:58 -04:00
2010-05-27 09:12:44 -07:00
2010-07-29 15:16:18 -07:00
2010-05-19 22:03:14 +03:00
2010-05-15 07:16:33 -04:00
2010-05-19 22:41:57 -04:00
2010-07-04 10:40:17 -07:00
2010-05-27 09:12:53 -07:00
2010-05-17 16:30:58 -07:00
2010-05-21 19:30:44 +02:00
2010-05-18 01:25:00 +02:00
2010-05-18 01:25:00 +02:00
2010-06-14 12:19:41 +02:00
2010-07-04 20:17:22 -07:00
2010-06-30 15:00:50 -04:00
2010-05-17 10:00:15 +02:00
2010-05-21 20:29:10 -07:00
2010-05-25 08:07:02 -07:00
2010-07-24 20:49:29 -07:00
2010-07-07 15:59:38 -07:00
2010-05-21 19:30:39 +02:00
2010-05-27 22:05:02 -04:00
2010-07-20 15:24:09 +10:00
2010-05-21 21:12:40 +02:00
2010-07-20 16:25:41 -07:00
2010-05-24 00:36:13 -07:00
2010-05-27 22:03:07 -04:00
2010-06-25 21:33:12 -07:00
2010-05-19 00:26:30 +02:00
2010-05-21 09:37:28 -07:00
2010-08-04 10:28:39 -07:00
2010-07-11 22:22:23 +02:00
2010-05-27 15:23:47 -07:00
2010-05-18 08:35:04 -07:00
2010-05-25 15:06:06 +02:00
2010-05-21 18:31:18 -04:00
2010-05-25 08:07:01 -07:00
2010-05-27 09:12:42 -07:00
2010-05-21 09:34:29 -07:00
2010-07-19 11:54:16 +02:00
2010-05-25 08:07:01 -07:00
2010-05-20 00:18:59 +01:00
2010-05-22 00:36:56 -06:00
2010-06-30 01:21:38 -07:00
2010-06-16 18:08:13 +02:00
2010-10-11 15:04:21 -04:00
2010-06-05 02:23:17 -07:00
2010-06-02 07:11:15 -07:00
2010-06-03 03:21:52 -07:00
2010-06-03 03:21:52 -07:00
2010-06-03 03:21:52 -07:00
2010-06-03 03:21:52 -07:00
2010-08-04 15:31:02 -07:00
2010-07-27 21:01:35 -07:00
2010-06-02 05:53:56 -07:00
2010-06-03 03:21:52 -07:00
2010-06-15 11:48:58 -07:00
2010-06-23 13:16:38 -07:00
2010-06-01 08:55:52 -07:00
2010-07-15 23:52:33 -07:00
2010-08-03 09:49:09 -04:00
2010-05-21 10:48:12 -07:00
2010-05-24 09:06:59 +02:00
2010-05-11 12:01:10 -07:00
2010-06-22 08:07:01 +02:00
2010-07-19 22:01:26 -07:00
2010-05-19 17:33:38 +09:30
2010-05-11 13:02:38 -04:00
2010-05-11 13:02:23 -04:00
2010-06-03 03:21:52 -07:00
2010-05-25 08:07:09 -07:00
2010-07-15 15:17:47 -07:00
2010-05-21 19:30:40 +02:00
2010-07-11 21:41:23 +02:00
2010-05-20 23:05:28 -07:00
2010-08-03 00:42:17 -07:00
2010-05-20 21:04:27 -05:00
2010-08-04 15:31:02 -07:00
2010-05-20 21:04:29 -05:00
2010-05-27 09:12:45 -07:00
2010-05-21 09:37:32 -07:00
2010-05-21 09:37:29 -07:00
2010-07-27 20:48:19 -07:00
2010-05-14 15:09:32 -04:00
2010-08-02 06:40:39 +03:00
2010-08-02 06:39:44 +03:00
2010-08-01 10:47:00 +03:00
2010-05-26 17:34:16 +01:00
2010-05-26 13:07:55 +01:00
2010-06-02 13:50:10 -04:00
2010-05-25 08:07:07 -07:00
2010-06-29 10:38:22 -07:00
2010-05-21 09:37:30 -07:00
2010-06-16 18:03:15 +02:00
2010-08-02 15:35:11 +10:00
2010-08-04 11:47:58 -07:00
2010-05-25 08:07:09 -07:00
2010-07-14 17:14:00 +10:00
2010-05-27 09:12:44 -07:00
2010-05-25 08:07:00 -07:00
2010-05-25 08:06:57 -07:00
2010-05-18 00:52:36 -03:00
2010-05-25 08:06:59 -07:00
2010-06-09 08:50:31 -07:00
2010-06-03 03:21:52 -07:00
2010-08-01 10:35:26 +03:00
2010-05-27 09:12:57 -07:00
2010-05-21 17:15:44 -07:00
2010-06-05 11:17:36 +09:30
2010-06-30 13:01:11 -07:00
2010-06-03 03:21:52 -07:00
2010-06-03 03:21:52 -07:00
2010-05-17 05:27:42 +02:00
2010-06-03 03:21:52 -07:00
2010-07-02 21:59:08 -07:00
2010-08-16 15:26:40 -04:00
2010-05-21 09:37:32 -07:00
2010-06-15 21:44:29 -07:00
2010-05-14 15:09:30 -04:00
2010-08-01 15:10:01 -07:00
2010-05-14 15:09:30 -04:00
2010-10-11 15:04:20 -04:00
2010-05-30 09:00:03 -07:00
2010-05-31 00:28:35 -07:00
2010-05-22 00:10:41 -06:00
2010-05-22 00:10:40 -06:00
2010-07-27 08:48:23 +01:00
2010-07-31 19:53:06 +08:00
2010-05-27 09:12:44 -07:00
2010-08-04 11:47:58 -07:00
2010-05-21 18:58:52 -07:00
2010-07-16 11:39:48 -07:00
2010-06-01 08:55:52 -07:00
2010-06-27 18:50:00 +02:00
2010-05-31 08:46:09 +02:00
2010-06-04 15:21:45 -07:00
2010-06-03 03:21:52 -07:00
2010-07-18 19:15:26 -07:00
2010-06-03 14:54:39 +02:00
2010-05-17 21:37:40 +02:00
2010-07-19 01:58:48 +02:00
2010-07-19 02:00:34 +02:00
2010-07-19 01:58:48 +02:00
2010-07-19 02:01:06 +02:00
2010-07-19 01:58:48 +02:00
2010-05-19 12:14:42 +04:00
2010-08-04 21:53:17 -07:00
2010-07-18 19:15:26 -07:00
2010-05-27 18:56:27 +02:00
2010-05-30 09:11:11 -07:00
2010-05-21 18:31:26 -04:00
2010-05-27 09:12:52 -07:00
2010-08-03 09:48:50 -04:00
2010-05-25 08:07:03 -07:00
2010-07-05 14:43:50 +02:00
2010-05-18 08:27:54 -07:00
2010-05-18 08:27:54 -07:00
2010-06-03 03:21:52 -07:00
2010-05-21 18:31:19 -04:00
2010-07-19 11:02:51 +02:00
2010-05-21 18:31:19 -04:00
2010-05-27 09:12:50 -07:00
2010-05-27 09:12:50 -07:00
2010-05-27 09:12:51 -07:00
2010-05-30 09:02:47 -07:00
2010-05-25 08:06:58 -07:00
2010-07-22 13:46:21 -07:00
2010-07-29 15:16:18 -07:00
2010-06-03 03:21:52 -07:00
2010-05-27 09:12:39 -07:00
2010-08-02 15:33:40 +10:00
2010-05-27 09:12:49 -07:00
2010-05-21 11:08:05 -07:00
2010-05-25 12:22:33 +09:00
2010-05-25 11:41:43 -04:00
2010-05-13 18:42:25 +09:00
2010-08-04 21:53:14 -07:00
2010-05-19 22:03:13 +03:00
2010-05-19 22:03:13 +03:00
2010-05-30 13:02:08 +03:00
2010-06-03 03:18:19 -07:00
2010-06-16 14:55:35 -07:00
2010-06-01 08:55:52 -07:00
2010-05-21 21:12:40 +02:00
2010-07-19 02:00:35 +02:00
2010-05-27 09:12:43 -07:00
2010-06-07 11:59:27 -04:00
2010-07-09 15:53:04 -04:00
2010-05-15 23:28:39 -07:00
2010-05-21 09:37:31 -07:00
2010-07-21 19:27:07 -05:00
2010-05-19 11:36:34 +03:00
2010-05-27 09:12:51 -07:00
2010-08-03 09:48:45 -04:00
2010-05-12 23:02:23 -07:00
2010-05-12 23:02:23 -07:00
2010-05-27 09:12:57 -07:00
2010-06-21 12:23:36 -04:00
2010-05-21 09:34:29 -07:00
2010-07-11 21:38:56 +02:00
2010-06-28 23:24:30 -07:00
2010-05-20 23:05:28 -07:00
2010-05-20 13:21:50 -07:00
2010-06-16 14:55:34 -07:00
2010-05-19 22:40:47 -04:00
2010-07-21 09:51:15 +10:00
2010-05-11 16:07:59 -06:00
2010-05-11 16:07:59 -06:00
2010-05-11 16:07:59 -06:00
2010-05-19 12:58:37 -03:00
2010-08-02 10:37:17 -05:00
2010-05-19 22:15:40 +09:30
2010-05-19 22:15:49 +09:30
2010-05-19 22:15:46 +09:30
2010-05-25 08:06:59 -07:00
2010-05-20 21:26:12 -07:00
2010-10-13 15:45:21 -04:00
2010-09-30 06:01:56 +03:00
2010-06-03 03:21:52 -07:00
2010-07-06 08:54:08 +02:00
2010-08-02 15:34:57 +10:00
2010-05-17 21:37:42 +02:00
10d8dad845