Commit 9bc39bec authored by Pavel Roskin's avatar Pavel Roskin Committed by Jeff Garzik

[PATCH] orinoco: Information leakage due to incorrect padding

The orinoco driver can send uninitialized data exposing random pieces of
the system memory.  This happens because data is not padded with zeroes
when its length needs to be increased.

Reported by Meder Kydyraliev <meder@o0o.nu>
Signed-off-by: default avatarPavel Roskin <proski@gnu.org>
Signed-off-by: default avatarJeff Garzik <jgarzik@pobox.com>
parent bb77c03c
...@@ -503,9 +503,14 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -503,9 +503,14 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
return 0; return 0;
} }
/* Length of the packet body */ /* Check packet length, pad short packets, round up odd length */
/* FIXME: what if the skb is smaller than this? */ len = max_t(int, ALIGN(skb->len, 2), ETH_ZLEN);
len = max_t(int,skb->len - ETH_HLEN, ETH_ZLEN - ETH_HLEN); if (skb->len < len) {
skb = skb_padto(skb, len);
if (skb == NULL)
goto fail;
}
len -= ETH_HLEN;
eh = (struct ethhdr *)skb->data; eh = (struct ethhdr *)skb->data;
...@@ -557,8 +562,7 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -557,8 +562,7 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
p = skb->data; p = skb->data;
} }
/* Round up for odd length packets */ err = hermes_bap_pwrite(hw, USER_BAP, p, data_len,
err = hermes_bap_pwrite(hw, USER_BAP, p, ALIGN(data_len, 2),
txfid, data_off); txfid, data_off);
if (err) { if (err) {
printk(KERN_ERR "%s: Error %d writing packet to BAP\n", printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment