wifi: avoid kernel-infoleak from struct iw_point

struct iw_point has a 32bit hole on 64bit arches.

struct iw_point {
  void __user   *pointer;       /* Pointer to the data  (in user space) */
  __u16         length;         /* number of fields or size in bytes */
  __u16         flags;          /* Optional params */
};

Make sure to zero the structure to avoid disclosing 32bits of kernel data
to user space.

Fixes: 87de87d5e47f ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c")
Reported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index c32a7c6903d53686bc5b51652a7c0574e7085659..7b8e94214b07224ffda4852d9e8a471a5fb18637 100644 (file)
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -1101,6 +1101,10 @@ static int compat_standard_call(struct net_device        *dev,
                return ioctl_standard_call(dev, iwr, cmd, info, handler);
 
        iwp_compat = (struct compat_iw_point *) &iwr->u.data;
+
+       /* struct iw_point has a 32bit hole on 64bit arches. */
+       memset(&iwp, 0, sizeof(iwp));
+
        iwp.pointer = compat_ptr(iwp_compat->pointer);
        iwp.length = iwp_compat->length;
        iwp.flags = iwp_compat->flags;

diff --git a/net/wireless/wext-priv.c b/net/wireless/wext-priv.c
index 674d426a9d24f9aab7657d1e8ecf342e3be87438..37d1147019c2baba3e3792bb98f098294cba00ec 100644 (file)
--- a/net/wireless/wext-priv.c
+++ b/net/wireless/wext-priv.c
@@ -228,6 +228,10 @@ int compat_private_call(struct net_device *dev, struct iwreq *iwr,
                struct iw_point iwp;
 
                iwp_compat = (struct compat_iw_point *) &iwr->u.data;
+
+               /* struct iw_point has a 32bit hole on 64bit arches. */
+               memset(&iwp, 0, sizeof(iwp));
+
                iwp.pointer = compat_ptr(iwp_compat->pointer);
                iwp.length = iwp_compat->length;
                iwp.flags = iwp_compat->flags;