nl80211/cfg80211: Make addition of new sinfo fields safer

Add a comment pointing out the use of enum station_info_flags for
all new struct station_info fields. In addition, memset the sinfo
buffer to zero before use on all paths in the current tree to avoid
leaving uninitialized pointers in the data.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 69448296e4ac73bd13873b7fecdf51a69d27cbbf..e95d3acaff0602f0f465904f4483d94e4f32dc8f 100644 (file)
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -566,6 +566,11 @@ struct station_info {
 
        const u8 *assoc_req_ies;
        size_t assoc_req_ies_len;
+
+       /*
+        * Note: Add a new enum station_info_flags value for each new field and
+        * use it to check which fields are initialized.
+        */
 };
 
 /**

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index ca7bf1052eba2e27e9e9ffa7ade276e02646e513..3ff633e81b680dc477338f4c372b7241dce15ca9 100644 (file)
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -334,6 +334,7 @@ static int sta_info_finish_insert(struct sta_info *sta, bool async)
        ieee80211_sta_debugfs_add(sta);
        rate_control_add_sta_debugfs(sta);
 
+       memset(&sinfo, 0, sizeof(sinfo));
        sinfo.filled = 0;
        sinfo.generation = local->sta_generation;
        cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 863e502f05872e6df4c57387f525ec6b84a20534..33115be4936f3ec48db305b3bb271b4a776c6627 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2240,6 +2240,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
        }
 
        while (1) {
+               memset(&sinfo, 0, sizeof(sinfo));
                err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
                                             mac_addr, &sinfo);
                if (err == -ENOENT)