]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
wifi: avoid kernel-infoleak from struct iw_point
authorEric Dumazet <edumazet@google.com>
Thu, 8 Jan 2026 10:19:27 +0000 (10:19 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 17 Jan 2026 15:35:14 +0000 (16:35 +0100)
commite3c35177103ead4658b8a62f41e3080d45885464
treea76397a115dd02f5c6542f2e76cc9c5b288674fe
parent5c12a13522f45f4ce0c22c2715879234e38bc12b
wifi: avoid kernel-infoleak from struct iw_point

commit 21cbf883d073abbfe09e3924466aa5e0449e7261 upstream.

struct iw_point has a 32bit hole on 64bit arches.

struct iw_point {
  void __user   *pointer;       /* Pointer to the data  (in user space) */
  __u16         length;         /* number of fields or size in bytes */
  __u16         flags;          /* Optional params */
};

Make sure to zero the structure to avoid disclosing 32bits of kernel data
to user space.

Fixes: 87de87d5e47f ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c")
Reported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/wireless/wext-core.c
net/wireless/wext-priv.c