]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
wifi: avoid kernel-infoleak from struct iw_point
authorEric Dumazet <edumazet@google.com>
Thu, 8 Jan 2026 10:19:27 +0000 (10:19 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 19 Jan 2026 12:10:14 +0000 (13:10 +0100)
commita3827e310b5a73535646ef4a552d53b3c8bf74f6
tree3917aefdce0e8747bccc93a89652fa166fe962c3
parent6a0cceb1a8b9e73a207b2ac03da03ccb8d17edaf
wifi: avoid kernel-infoleak from struct iw_point

commit 21cbf883d073abbfe09e3924466aa5e0449e7261 upstream.

struct iw_point has a 32bit hole on 64bit arches.

struct iw_point {
  void __user   *pointer;       /* Pointer to the data  (in user space) */
  __u16         length;         /* number of fields or size in bytes */
  __u16         flags;          /* Optional params */
};

Make sure to zero the structure to avoid disclosing 32bits of kernel data
to user space.

Fixes: 87de87d5e47f ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c")
Reported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/wireless/wext-core.c
net/wireless/wext-priv.c