Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932472AbbG1JpG (ORCPT ); Tue, 28 Jul 2015 05:45:06 -0400 Received: from mail-wi0-f179.google.com ([209.85.212.179]:33405 "EHLO mail-wi0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932390AbbG1Jov (ORCPT ); Tue, 28 Jul 2015 05:44:51 -0400 From: Jiri Slaby To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Johannes Berg , "David S. Miller" , Jiri Slaby Subject: [PATCH 3.12 026/124] cfg80211: wext: clear sinfo struct before calling driver Date: Tue, 28 Jul 2015 11:42:40 +0200 Message-Id: <27ea4a8d98cb59b5ee41e36e1165117a63d70555.1438076484.git.jslaby@suse.cz> X-Mailer: git-send-email 2.4.6 In-Reply-To: <90d8a5681e4a9e320611b422f0ed012e148c2bca.1438076484.git.jslaby@suse.cz> References: <90d8a5681e4a9e320611b422f0ed012e148c2bca.1438076484.git.jslaby@suse.cz> In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2080 Lines: 57 From: Johannes Berg 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit 9c5a18a31b321f120efda412281bb9f610f84aa0 upstream. Until recently, mac80211 overwrote all the statistics it could provide when getting called, but it now relies on the struct having been zeroed by the caller. This was always the case in nl80211, but wext used a static struct which could even cause values from one device leak to another. Using a static struct is OK (as even documented in a comment) since the whole usage of this function and its return value is always locked under RTNL. Not clearing the struct for calling the driver has always been wrong though, since drivers were free to only fill values they could report, so calling this for one device and then for another would always have leaked values from one to the other. Fix this by initializing the structure in question before the driver method call. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=99691 Reported-by: Gerrit Renker Reported-by: Alexander Kaltsas Signed-off-by: Johannes Berg Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby --- net/wireless/wext-compat.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c index e7c6e862580d..6863d8458a29 100644 --- a/net/wireless/wext-compat.c +++ b/net/wireless/wext-compat.c @@ -1331,6 +1331,8 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev) memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN); wdev_unlock(wdev); + memset(&sinfo, 0, sizeof(sinfo)); + if (rdev_get_station(rdev, dev, bssid, &sinfo)) return NULL; -- 2.4.6 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/