Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9bc39bec authored by Pavel Roskin's avatar Pavel Roskin Committed by Jeff Garzik
Browse files

[PATCH] orinoco: Information leakage due to incorrect padding 



The orinoco driver can send uninitialized data exposing random pieces of
the system memory.  This happens because data is not padded with zeroes
when its length needs to be increased.

Reported by Meder Kydyraliev <meder@o0o.nu>

Signed-off-by: default avatarPavel Roskin <proski@gnu.org>
Signed-off-by: default avatarJeff Garzik <jgarzik@pobox.com>
parent bb77c03c

drivers/net/wireless/orinoco.c

+9 −5
Original line number Diff line number Diff line
@@ -503,9 +503,14 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev) 
		return 0;

	}



	/* Length of the packet body */

	/* FIXME: what if the skb is smaller than this? */

	len = max_t(int,skb->len - ETH_HLEN, ETH_ZLEN - ETH_HLEN);

	/* Check packet length, pad short packets, round up odd length */

	len = max_t(int, ALIGN(skb->len, 2), ETH_ZLEN);

	if (skb->len < len) {

		skb = skb_padto(skb, len);

		if (skb == NULL)

			goto fail;

	}

	len -= ETH_HLEN;



	eh = (struct ethhdr *)skb->data;
@@ -557,8 +562,7 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev) 
		p = skb->data;

	}



	/* Round up for odd length packets */

	err = hermes_bap_pwrite(hw, USER_BAP, p, ALIGN(data_len, 2),

	err = hermes_bap_pwrite(hw, USER_BAP, p, data_len,

				txfid, data_off);

	if (err) {

		printk(KERN_ERR "%s: Error %d writing packet to BAP\n",