Skip to content
Commit 68dd02d1 authored by Johannes Berg's avatar Johannes Berg
Browse files

dev_ioctl: copy only the smaller struct iwreq for wext

Unfortunately, struct iwreq isn't a proper subset of struct ifreq,
but is still handled by the same code path. Robert reported that
then applications may (randomly) fault if the struct iwreq they
pass happens to land within 8 bytes of the end of a mapping (the
struct is only 32 bytes, vs. struct ifreq's 40 bytes).

To fix this, pull out the code handling wireless extension ioctls
and copy only the smaller structure in this case.

This bug goes back a long time, I tracked that it was introduced
into mainline in 2.1.15, over 20 years ago!

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=195869



Reported-by: default avatarRobert O'Callahan <robert@ocallahan.org>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 4f39a1f5
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment