From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933141AbdLGP6U (ORCPT ); Thu, 7 Dec 2017 10:58:20 -0500 Received: from omzsmtpe01.verizonbusiness.com ([199.249.25.210]:5574 "EHLO omzsmtpe01.verizonbusiness.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932476AbdLGP55 (ORCPT ); Thu, 7 Dec 2017 10:57:57 -0500 From: alexander.levin@verizon.com Cc: Miaoqing Pan , Kalle Valo , alexander.levin@verizon.com X-Host: pioneer.tdc.vzwcorp.com To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" Subject: [PATCH AUTOSEL for 3.18 59/59] ath9k: fix tx99 potential info leak Thread-Topic: [PATCH AUTOSEL for 3.18 59/59] ath9k: fix tx99 potential info leak Thread-Index: AQHTb3NEDUH4MC4AdkakxUINkvacTQ== Date: Thu, 7 Dec 2017 15:51:37 +0000 Message-ID: <20171207155116.6013-59-alexander.levin@verizon.com> References: <20171207155116.6013-1-alexander.levin@verizon.com> In-Reply-To: <20171207155116.6013-1-alexander.levin@verizon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.144.60.250] Content-Type: text/plain; charset="utf-8" Content-ID: <5D2C4C48647BE448B44A169A247B7416@vzwcorp.com> MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by nfs id vB7GBecA002121 From: Miaoqing Pan [ Upstream commit ee0a47186e2fa9aa1c56cadcea470ca0ba8c8692 ] When the user sets count to zero the string buffer would remain completely uninitialized which causes the kernel to parse its own stack data, potentially leading to an info leak. In addition to that, the string might be not terminated properly when the user data does not contain a 0-terminator. Signed-off-by: Miaoqing Pan Reviewed-by: Christoph Böhmwalder Signed-off-by: Kalle Valo Signed-off-by: Sasha Levin --- drivers/net/wireless/ath/ath9k/tx99.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c index 2ea3589f709f..b7ab8455ffbd 100644 --- a/drivers/net/wireless/ath/ath9k/tx99.c +++ b/drivers/net/wireless/ath/ath9k/tx99.c @@ -180,6 +180,9 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf, ssize_t len; int r; + if (count < 1) + return -EINVAL; + if (sc->cur_chan->nvifs > 1) return -EOPNOTSUPP; @@ -187,6 +190,8 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf, if (copy_from_user(buf, user_buf, len)) return -EFAULT; + buf[len] = '\0'; + if (strtobool(buf, &start)) return -EINVAL; -- 2.11.0