From: Pavel Roskin Date: Wed, 5 Oct 2005 01:33:10 +0000 (-0400) Subject: [PATCH] orinoco: Information leakage due to incorrect padding X-Git-Tag: v2.6.14-rc4~44 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9bc39bec87ee3e35897fe27441e979e7c208f624;p=linux-2.6 [PATCH] orinoco: Information leakage due to incorrect padding The orinoco driver can send uninitialized data exposing random pieces of the system memory. This happens because data is not padded with zeroes when its length needs to be increased. Reported by Meder Kydyraliev Signed-off-by: Pavel Roskin Signed-off-by: Jeff Garzik --- diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c index 6deb7cc810..cf3daaa1b3 100644 --- a/drivers/net/wireless/orinoco.c +++ b/drivers/net/wireless/orinoco.c @@ -503,9 +503,14 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev) return 0; } - /* Length of the packet body */ - /* FIXME: what if the skb is smaller than this? */ - len = max_t(int,skb->len - ETH_HLEN, ETH_ZLEN - ETH_HLEN); + /* Check packet length, pad short packets, round up odd length */ + len = max_t(int, ALIGN(skb->len, 2), ETH_ZLEN); + if (skb->len < len) { + skb = skb_padto(skb, len); + if (skb == NULL) + goto fail; + } + len -= ETH_HLEN; eh = (struct ethhdr *)skb->data; @@ -557,8 +562,7 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev) p = skb->data; } - /* Round up for odd length packets */ - err = hermes_bap_pwrite(hw, USER_BAP, p, ALIGN(data_len, 2), + err = hermes_bap_pwrite(hw, USER_BAP, p, data_len, txfid, data_off); if (err) { printk(KERN_ERR "%s: Error %d writing packet to BAP\n",