Hello,
Our UC-KLEE tool found an uninitialized memcpy length (segfault) bug in
airo_get_essid (drivers/net/wireless/airo.c). We found the bug in kernel
3.16.3, but it appears to date back beyond the original kernel git commit in
2005 (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2).
The offending code is as follows:
5912 readStatusRid(local, &status_rid, 1);
5913
5914 /* Note : if dwrq->flags != 0, we should
5915 * get the relevant SSID from the SSID list... */
5916
5917 /* Get the current SSID */
5918 memcpy(extra, status_rid.SSID, le16_to_cpu(status_rid.SSIDlen));
The call to readStatusRid() on line 5912 fails if PC4500_readrid() fails, which
can happen if down_interruptible() fails (e.g., is interrupted). This leaves
the ‘status_rid’ struct uninitialized. The memcpy() at line 5918 then uses
garbage values from the stack as the memcpy length, which can corrupt memory or
cause a kernel segfault.
The recommended fix is to check the return value of readStatusRid() and return
an error when it fails.
Please let me know if you have any questions.
Thanks,
-David
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
