]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: avoid kernel-infoleak from struct iw_point
authorEric Dumazet <edumazet@google.com>
Thu, 8 Jan 2026 10:19:27 +0000 (10:19 +0000)
committerJohannes Berg <johannes.berg@intel.com>
Thu, 8 Jan 2026 12:33:05 +0000 (13:33 +0100)
commit21cbf883d073abbfe09e3924466aa5e0449e7261
tree0812cb683f541bcd151bba1d1726198f9123cb18
parentdbf8fe85a16a33d6b6bd01f2bc606fc017771465
wifi: avoid kernel-infoleak from struct iw_point

struct iw_point has a 32bit hole on 64bit arches.

struct iw_point {
  void __user   *pointer;       /* Pointer to the data  (in user space) */
  __u16         length;         /* number of fields or size in bytes */
  __u16         flags;          /* Optional params */
};

Make sure to zero the structure to avoid disclosing 32bits of kernel data
to user space.

Fixes: 87de87d5e47f ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c")
Reported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/wireless/wext-core.c
net/wireless/wext-priv.c