Eric Dumazet a3827e310b wifi: avoid kernel-infoleak from struct iw_point ...

commit 21cbf883d0 upstream.

struct iw_point has a 32bit hole on 64bit arches.

struct iw_point {
  void __user   *pointer;       /* Pointer to the data  (in user space) */
  __u16         length;         /* number of fields or size in bytes */
  __u16         flags;          /* Optional params */
};

Make sure to zero the structure to avoid disclosing 32bits of kernel data
to user space.

Fixes: 87de87d5e4 ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c")
Reported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-19 13:10:14 +01:00

..

certs

wifi: cfg80211: fix certs build to not depend on file order

2024-01-05 15:13:33 +01:00

.gitignore

…

ap.c

…

chan.c

cfg80211: add cfg80211_any_usable_channels()

2021-06-23 13:05:08 +02:00

core.c

wifi: cfg80211: lock wiphy mutex for rfkill poll

2024-01-25 14:52:27 -08:00

core.h

Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex"

2024-10-17 15:10:41 +02:00

debugfs.c

wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()

2022-09-08 12:28:02 +02:00

debugfs.h

…

ethtool.c

…

ibss.c

cfg80211: avoid holding the RTNL when calling the driver

2021-01-26 11:55:50 +01:00

Kconfig

cfg80211: select CONFIG_CRC32

2021-01-05 15:50:36 -08:00

lib80211_crypt_ccmp.c

…

lib80211_crypt_tkip.c

…

lib80211_crypt_wep.c

…

lib80211.c

…

Makefile

cfg80211: make certificate generation more robust

2021-06-18 13:25:15 +02:00

mesh.c

…

mlme.c

wifi: cfg80211: reject HTC bit for management frames

2025-08-28 16:24:20 +02:00

nl80211.c

wifi: nl80211: reject cooked mode if it is set along with other flags

2025-03-13 12:51:03 +01:00

nl80211.h

nl80211: fix radio statistics in survey dump

2021-11-25 09:48:34 +01:00

ocb.c

…

of.c

…

pmsr.c

wifi: cfg80211: pmsr: use correct nla_get_uX functions

2024-07-05 09:14:05 +02:00

radiotap.c

mac80211: Use flex-array for radiotap header bitmap

2021-08-13 09:58:25 +02:00

rdev-ops.h

nl80211: add support for BSS coloring

2021-08-17 11:58:21 +02:00

reg.c

wifi: cfg80211: regulatory: improve invalid hints checking

2025-03-13 12:51:02 +01:00

reg.h

cfg80211: avoid holding the RTNL when calling the driver

2021-01-26 11:55:50 +01:00

scan.c

wifi: cfg80211: fix use-after-free in cmp_bss()

2025-09-09 18:50:18 +02:00

sme.c

wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors

2024-10-17 15:10:45 +02:00

sysfs.c

cfg80211: shut down interfaces on failed resume

2021-06-09 16:09:20 +02:00

sysfs.h

…

trace.c

…

trace.h

wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class

2024-06-16 13:39:13 +02:00

util.c

wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()

2024-08-19 05:44:57 +02:00

wext-compat.c

cfg80211: expose the rfkill device to the low level driver

2021-06-23 11:29:13 +02:00

wext-compat.h

…

wext-core.c

wifi: avoid kernel-infoleak from struct iw_point

2026-01-19 13:10:14 +01:00

wext-priv.c

wifi: avoid kernel-infoleak from struct iw_point

2026-01-19 13:10:14 +01:00

wext-proc.c

…

wext-sme.c

cfg80211: avoid holding the RTNL when calling the driver

2021-01-26 11:55:50 +01:00

wext-spy.c

wireless: wext-spy: Fix out-of-bounds warning

2021-06-23 10:57:17 +02:00