linux/net
Johannes Berg b381cabc48 wext: fix potential private ioctl memory content leak
commit df6d02300f upstream.

When a driver doesn't fill the entire buffer, old
heap contents may remain, and if it also doesn't
update the length properly, this old heap content
will be copied back to userspace.

It is very unlikely that this happens in any of
the drivers using private ioctls since it would
show up as junk being reported by iwpriv, but it
seems better to be safe here, so use kzalloc.

Reported-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-10-28 21:44:02 -07:00
..
9p 9p: strlen() doesn't count the terminator 2010-08-10 10:20:39 -07:00
802
8021q vlan: Fix register_vlan_dev() error path 2009-11-17 06:45:04 -08:00
appletalk Have atalk_route_packet() return NET_RX_SUCCESS not NET_XMIT_SUCCESS 2009-09-14 17:02:47 -07:00
atm net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
ax25 ax25: netrom: rose: Fix timer oopses 2010-02-09 04:50:56 -08:00
bluetooth Bluetooth: Fix kernel crash on L2CAP stress tests 2010-04-01 15:58:55 -07:00
bridge bridge: Clear INET control block of SKBs passed into ip_fragment(). 2010-09-26 17:21:19 -07:00
can can: add limit for nframes and clean up signed/unsigned variables 2010-08-26 16:41:51 -07:00
core gro: Fix bogus gso_size on the first fraglist entry 2010-09-26 17:21:37 -07:00
dcb net: fix double skb free in dcbnl 2009-09-26 20:16:15 -07:00
dccp dccp_probe: Fix module load dependencies between dccp and dccp_probe 2010-05-12 14:57:11 -07:00
decnet decnet: netdevice refcount leak 2009-11-06 00:50:39 -08:00
dsa netdev: convert pseudo-devices to netdev_tx_t 2009-09-01 01:13:07 -07:00
econet Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-08-12 17:44:53 -07:00
ethernet
ieee802154 net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
ipv4 net: Fix oops from tcp_collapse() when using splice() 2010-09-26 17:21:20 -07:00
ipv6 netfilter: ip6t_REJECT: fix a dst leak in ipv6 REJECT 2010-08-02 10:20:50 -07:00
ipx net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
irda irda: Correctly clean up self->ias_obj on irda_bind() failure. 2010-09-26 17:21:16 -07:00
iucv net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
key net: file_operations should be const 2009-09-02 01:03:53 -07:00
lapb net: remove NET_RX_BAD and NET_RX_CN* defines 2009-07-05 19:15:35 -07:00
llc net/llc: make opt unsigned in llc_ui_setsockopt() 2010-09-26 17:21:24 -07:00
mac80211 mac80211: fix supported rates IE if AP doesn't give us it's rates 2010-08-02 10:21:27 -07:00
netfilter ipvs: Add missing locking during connection table hashing and unhashing 2010-08-02 10:20:50 -07:00
netlabel Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-07-30 19:22:43 -07:00
netlink netlink: fix compat recvmsg 2010-08-26 16:41:55 -07:00
netrom ax25: netrom: rose: Fix timer oopses 2010-02-09 04:50:56 -08:00
packet af_packet: Don't use skb after dev_queue_xmit() 2010-02-09 04:50:56 -08:00
phonet Phonet: fix mutex imbalance 2009-09-30 16:41:34 -07:00
rds rds: fix a leak of kernel memory 2010-09-26 17:21:20 -07:00
rfkill Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 2009-11-23 14:01:47 -08:00
rose ax25: netrom: rose: Fix timer oopses 2010-02-09 04:50:56 -08:00
rxrpc net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
sched act_nat: the checksum of ICMP doesn't have pseudo header 2010-08-26 16:41:52 -07:00
sctp sctp: Do not reset the packet during sctp_packet_config(). 2010-09-26 17:21:35 -07:00
sunrpc SUNRPC: Fix race corrupting rpc upcall 2010-09-20 13:18:14 -07:00
tipc tipc: Fix oops on send prior to entering networked mode (v3) 2010-07-05 11:11:16 -07:00
unix UNIX: Do not loop forever at unix_autobind(). 2010-09-26 17:21:21 -07:00
wanrouter headers: smp_lock.h redux 2009-07-12 12:22:34 -07:00
wimax
wireless wext: fix potential private ioctl memory content leak 2010-10-28 21:44:02 -07:00
x25 net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
xfrm net: file_operations should be const 2009-09-02 01:03:53 -07:00
compat.c net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
Kconfig net/compat/wext: send different messages to compat tasks 2009-07-15 08:53:39 -07:00
Makefile net: remove redundant sched/ in net/Makefile 2009-07-12 20:11:14 -07:00
nonet.c
socket.c net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
sysctl_net.c
TUNABLE