linux-toradex.git/net/wireless/wext.c, branch v2.6.30.2

wext: verify buffer size for SIOCSIWENCODEEXT

2009-05-20T18:07:50+00:00

Another design flaw in wireless extensions (is anybody
surprised?) in the way it handles the iw_encode_ext
structure: The structure is part of the 'extra' memory
but contains the key length explicitly, instead of it
just being the length of the extra buffer - size of
the struct and using the explicit key length only for
the get operation (which only writes it).

Therefore, we have this layout:

extra: +-------------------------+
       | struct iw_encode_ext  { |
       |     ...                 |
       |     u16 key_len;        |
       |     u8 key[0];          |
       | };                      |
       +-------------------------+
       | key material            |
       +-------------------------+

Now, all drivers I checked use ext->key_len without
checking that both key_len and the struct fit into the
extra buffer that has been copied from userspace. This
leads to a buffer overrun while reading that buffer,
depending on the driver it may be possible to specify
arbitrary key_len or it may need to be a proper length
for the key algorithm specified.

Thankfully, this is only exploitable by root, but root
can actually cause a segfault or use kernel memory as
a key (which you can even get back with siocgiwencode
or siocgiwencodeext from the key buffer).

Fix this by verifying that key_len fits into the buffer
along with struct iw_encode_ext.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

wireless: convert wireless ioctl to net_device_ops

2009-01-06T18:42:24+00:00

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

wireless: Fix incorrect use of loose in wext.c

2008-12-07T07:55:32+00:00

Fix incorrect use of loose in wext.c

It should be 'lose', not 'loose'.

Signed-off-by: Nick Andrew 
Signed-off-by: David S. Miller

wext: Send name on events

2008-08-13T09:39:56+00:00

In the minimal the wireless extensions oughta send at least
the name in addition to the ifindex.

Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

netns: Use net_eq() to compare net-namespaces for optimization.

2008-07-20T05:34:43+00:00

Without CONFIG_NET_NS, namespace is always &init_net.
Compiler will be able to omit namespace comparisons with this patch.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller

wext: Create IW_REQUEST_FLAG_COMPAT and set it as needed.

2008-06-17T01:34:49+00:00

Now low-level WEXT ioctl handlers can do compat handling
when necessary.

Signed-off-by: David S. Miller

wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c

2008-06-17T01:32:46+00:00

Next we can kill the hacks in fs/compat_ioctl.c and also
dispatch compat ioctls down into the driver and 80211 protocol
helper layers in order to handle iw_point objects embedded in
stream replies which need to be translated.

Signed-off-by: David S. Miller

wext: Pull top-level ioctl dispatch logic into helper function.

2008-06-17T01:32:09+00:00

Signed-off-by: David S. Miller

wext: Pass iwreq pointer down into standard/private handlers.

2008-06-17T01:31:55+00:00

They have no need to see the object as an ifreq.

Signed-off-by: David S. Miller

wext: Parameterize the standard/private handlers.

2008-06-17T01:30:59+00:00

The WEXT standard and private handlers to use are now
arguments to wireless_process_ioctl().

Signed-off-by: David S. Miller