aboutsummaryrefslogtreecommitdiffstats
path: root/include/net
diff options
context:
space:
mode:
authorJean Tourrilhes <jt@hpl.hp.com>2007-03-22 20:31:16 -0400
committerJohn W. Linville <linville@tuxdriver.com>2007-03-27 14:10:26 -0400
commitc2805fbb8630abb95d94ce7adc3f97976f7e0367 (patch)
treeca94be7f103d430d38ef6543db597e90f3a63999 /include/net
parented4bb1063171b2f44a40b0a9c400dedb0590dce6 (diff)
[PATCH] WE-22 : prevent information leak on 64 bit
Johannes Berg discovered that kernel space was leaking to userspace on 64 bit platform. He made a first patch to fix that. This is an improved version of his patch. Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'include/net')
-rw-r--r--include/net/iw_handler.h30
1 files changed, 21 insertions, 9 deletions
diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index 10559e937d27..8a830188354d 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -1,10 +1,10 @@
1/* 1/*
2 * This file define the new driver API for Wireless Extensions 2 * This file define the new driver API for Wireless Extensions
3 * 3 *
4 * Version : 7 18.3.05 4 * Version : 8 16.3.07
5 * 5 *
6 * Authors : Jean Tourrilhes - HPL - <jt@hpl.hp.com> 6 * Authors : Jean Tourrilhes - HPL - <jt@hpl.hp.com>
7 * Copyright (c) 2001-2006 Jean Tourrilhes, All Rights Reserved. 7 * Copyright (c) 2001-2007 Jean Tourrilhes, All Rights Reserved.
8 */ 8 */
9 9
10#ifndef _IW_HANDLER_H 10#ifndef _IW_HANDLER_H
@@ -207,7 +207,7 @@
207 * will be needed... 207 * will be needed...
208 * I just plan to increment with each new version. 208 * I just plan to increment with each new version.
209 */ 209 */
210#define IW_HANDLER_VERSION 7 210#define IW_HANDLER_VERSION 8
211 211
212/* 212/*
213 * Changes : 213 * Changes :
@@ -239,6 +239,10 @@
239 * - Remove (struct iw_point *)->pointer from events and streams 239 * - Remove (struct iw_point *)->pointer from events and streams
240 * - Remove spy_offset from struct iw_handler_def 240 * - Remove spy_offset from struct iw_handler_def
241 * - Add "check" version of event macros for ieee802.11 stack 241 * - Add "check" version of event macros for ieee802.11 stack
242 *
243 * V7 to V8
244 * ----------
245 * - Prevent leaking of kernel space in stream on 64 bits.
242 */ 246 */
243 247
244/**************************** CONSTANTS ****************************/ 248/**************************** CONSTANTS ****************************/
@@ -500,7 +504,11 @@ iwe_stream_add_event(char * stream, /* Stream of events */
500 /* Check if it's possible */ 504 /* Check if it's possible */
501 if(likely((stream + event_len) < ends)) { 505 if(likely((stream + event_len) < ends)) {
502 iwe->len = event_len; 506 iwe->len = event_len;
503 memcpy(stream, (char *) iwe, event_len); 507 /* Beware of alignement issues on 64 bits */
508 memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
509 memcpy(stream + IW_EV_LCP_LEN,
510 ((char *) iwe) + IW_EV_LCP_LEN,
511 event_len - IW_EV_LCP_LEN);
504 stream += event_len; 512 stream += event_len;
505 } 513 }
506 return stream; 514 return stream;
@@ -521,10 +529,10 @@ iwe_stream_add_point(char * stream, /* Stream of events */
521 /* Check if it's possible */ 529 /* Check if it's possible */
522 if(likely((stream + event_len) < ends)) { 530 if(likely((stream + event_len) < ends)) {
523 iwe->len = event_len; 531 iwe->len = event_len;
524 memcpy(stream, (char *) iwe, IW_EV_LCP_LEN); 532 memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
525 memcpy(stream + IW_EV_LCP_LEN, 533 memcpy(stream + IW_EV_LCP_LEN,
526 ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF, 534 ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
527 IW_EV_POINT_LEN - IW_EV_LCP_LEN); 535 IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
528 memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length); 536 memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length);
529 stream += event_len; 537 stream += event_len;
530 } 538 }
@@ -574,7 +582,11 @@ iwe_stream_check_add_event(char * stream, /* Stream of events */
574 /* Check if it's possible, set error if not */ 582 /* Check if it's possible, set error if not */
575 if(likely((stream + event_len) < ends)) { 583 if(likely((stream + event_len) < ends)) {
576 iwe->len = event_len; 584 iwe->len = event_len;
577 memcpy(stream, (char *) iwe, event_len); 585 /* Beware of alignement issues on 64 bits */
586 memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
587 memcpy(stream + IW_EV_LCP_LEN,
588 ((char *) iwe) + IW_EV_LCP_LEN,
589 event_len - IW_EV_LCP_LEN);
578 stream += event_len; 590 stream += event_len;
579 } else 591 } else
580 *perr = -E2BIG; 592 *perr = -E2BIG;
@@ -598,10 +610,10 @@ iwe_stream_check_add_point(char * stream, /* Stream of events */
598 /* Check if it's possible */ 610 /* Check if it's possible */
599 if(likely((stream + event_len) < ends)) { 611 if(likely((stream + event_len) < ends)) {
600 iwe->len = event_len; 612 iwe->len = event_len;
601 memcpy(stream, (char *) iwe, IW_EV_LCP_LEN); 613 memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
602 memcpy(stream + IW_EV_LCP_LEN, 614 memcpy(stream + IW_EV_LCP_LEN,
603 ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF, 615 ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
604 IW_EV_POINT_LEN - IW_EV_LCP_LEN); 616 IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
605 memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length); 617 memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length);
606 stream += event_len; 618 stream += event_len;
607 } else 619 } else