[PATCH] WE-22 : prevent information leak on 64 bit

 	Johannes Berg discovered that kernel space was leaking to
userspace on 64 bit platform. He made a first patch to fix that. This
is an improved version of his patch.

Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

2 files changed, 39 insertions, 12 deletions

diff --git a/include/linux/wireless.h b/include/linux/wireless.h
index 447c52beb691..48759b2f57d7 100644
--- a/include/linux/wireless.h
+++ b/include/linux/wireless.h
@@ -1,10 +1,10 @@
 /*
  * This file define a set of standard wireless extensions
  *
- * Version :    21      14.3.06
+ * Version :    22      16.3.07
  *
  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
- * Copyright (c) 1997-2006 Jean Tourrilhes, All Rights Reserved.
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
  */
 
 #ifndef _LINUX_WIRELESS_H
@@ -85,7 +85,7 @@
  * (there is some stuff that will be added in the future...)
  * I just plan to increment with each new version.
  */
-#define WIRELESS_EXT    21
+#define WIRELESS_EXT    22
 
 /*
  * Changes :
@@ -221,6 +221,10 @@
  *      - Add IW_RETRY_SHORT/IW_RETRY_LONG retry modifiers
  *      - Power/Retry relative values no longer * 100000
  *      - Add explicit flag to tell stats are in 802.11k RCPI : IW_QUAL_RCPI
+ *
+ * V21 to V22
+ * ----------
+ *      - Prevent leaking of kernel space in stream on 64 bits.
  */
 
 /**************************** CONSTANTS ****************************/
@@ -1085,4 +1089,15 @@ struct iw_event
 #define IW_EV_POINT_LEN (IW_EV_LCP_LEN + sizeof(struct iw_point) - \
                          IW_EV_POINT_OFF)
 
+/* Size of the Event prefix when packed in stream */
+#define IW_EV_LCP_PK_LEN        (4)
+/* Size of the various events when packed in stream */
+#define IW_EV_CHAR_PK_LEN       (IW_EV_LCP_PK_LEN + IFNAMSIZ)
+#define IW_EV_UINT_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(__u32))
+#define IW_EV_FREQ_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(struct iw_freq))
+#define IW_EV_PARAM_PK_LEN      (IW_EV_LCP_PK_LEN + sizeof(struct iw_param))
+#define IW_EV_ADDR_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(struct sockaddr))
+#define IW_EV_QUAL_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(struct iw_quality))
+#define IW_EV_POINT_PK_LEN      (IW_EV_LCP_LEN + 4)
+
 #endif  /* _LINUX_WIRELESS_H */
diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index 10559e937d27..8a830188354d 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -1,10 +1,10 @@
 /*
  * This file define the new driver API for Wireless Extensions
  *
- * Version :    7       18.3.05
+ * Version :    8       16.3.07
  *
  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
- * Copyright (c) 2001-2006 Jean Tourrilhes, All Rights Reserved.
+ * Copyright (c) 2001-2007 Jean Tourrilhes, All Rights Reserved.
  */
 
 #ifndef _IW_HANDLER_H
@@ -207,7 +207,7 @@
  * will be needed...
  * I just plan to increment with each new version.
  */
-#define IW_HANDLER_VERSION      7
+#define IW_HANDLER_VERSION      8
 
 /*
  * Changes :
@@ -239,6 +239,10 @@
  *      - Remove (struct iw_point *)->pointer from events and streams
  *      - Remove spy_offset from struct iw_handler_def
  *      - Add "check" version of event macros for ieee802.11 stack
+ *
+ * V7 to V8
+ * ----------
+ *      - Prevent leaking of kernel space in stream on 64 bits.
  */
 
 /**************************** CONSTANTS ****************************/
@@ -500,7 +504,11 @@ iwe_stream_add_event(char *	stream,		/* Stream of events */
         /* Check if it's possible */
         if(likely((stream + event_len) < ends)) {
                 iwe->len = event_len;
-                memcpy(stream, (char *) iwe, event_len);
+                /* Beware of alignement issues on 64 bits */
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
+                memcpy(stream + IW_EV_LCP_LEN,
+                       ((char *) iwe) + IW_EV_LCP_LEN,
+                       event_len - IW_EV_LCP_LEN);
                 stream += event_len;
         }
         return stream;
@@ -521,10 +529,10 @@ iwe_stream_add_point(char *	stream,		/* Stream of events */
         /* Check if it's possible */
         if(likely((stream + event_len) < ends)) {
                 iwe->len = event_len;
-                memcpy(stream, (char *) iwe, IW_EV_LCP_LEN);
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
                 memcpy(stream + IW_EV_LCP_LEN,
                        ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
                 memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length);
                 stream += event_len;
         }
@@ -574,7 +582,11 @@ iwe_stream_check_add_event(char *	stream,		/* Stream of events */
         /* Check if it's possible, set error if not */
         if(likely((stream + event_len) < ends)) {
                 iwe->len = event_len;
-                memcpy(stream, (char *) iwe, event_len);
+                /* Beware of alignement issues on 64 bits */
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
+                memcpy(stream + IW_EV_LCP_LEN,
+                       ((char *) iwe) + IW_EV_LCP_LEN,
+                       event_len - IW_EV_LCP_LEN);
                 stream += event_len;
         } else
                 *perr = -E2BIG;
@@ -598,10 +610,10 @@ iwe_stream_check_add_point(char *	stream,		/* Stream of events */
         /* Check if it's possible */
         if(likely((stream + event_len) < ends)) {
                 iwe->len = event_len;
-                memcpy(stream, (char *) iwe, IW_EV_LCP_LEN);
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
                 memcpy(stream + IW_EV_LCP_LEN,
                        ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
                 memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length);
                 stream += event_len;
         } else