From patchwork Sat Dec 3 10:27:37 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pan Bian X-Patchwork-Id: 9459597 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 334D46074E for ; Sat, 3 Dec 2016 10:49:39 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 29CC028490 for ; Sat, 3 Dec 2016 10:49:39 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1D77D2845C; Sat, 3 Dec 2016 10:49:39 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CD8012845C for ; Sat, 3 Dec 2016 10:49:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752220AbcLCKtQ (ORCPT ); Sat, 3 Dec 2016 05:49:16 -0500 Received: from m50-138.163.com ([123.125.50.138]:57597 "EHLO m50-138.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752160AbcLCKtN (ORCPT ); Sat, 3 Dec 2016 05:49:13 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id; bh=imsX0EB01YBbIaZcp0 Uvm+V9gs5/LChhkSZKdzSFKDs=; b=Xh8G4TY7rTCqpXQ3Vp+oKk1CivZq0Ck6bD MlSkIMT3f7JrQ3BFgUCZPJlY2AjPmWgQ9vWcoN2k79gsEH0i2Bt8Efr5UIiPeHYV gclvU+Wk29FVOnhwaz7/+UMcyINi6iU0Az7CAYTqVWXu3zZTpikiwPrpc47gxNke XYFOb0Gik= Received: from localhost.localdomain (unknown [222.131.246.88]) by smtp1 (Coremail) with SMTP id C9GowACHBggZnkJYyW4gIQ--.55469S3; Sat, 03 Dec 2016 18:27:40 +0800 (CST) From: Pan Bian To: Kalle Valo , Andreas Kemnade , Johannes Berg , libertas-dev@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Pan Bian Subject: [PATCH 1/1] net: wireless: marvell: fix improper return value Date: Sat, 3 Dec 2016 18:27:37 +0800 Message-Id: <1480760857-4549-1-git-send-email-bianpan2016@163.com> X-Mailer: git-send-email 1.9.1 X-CM-TRANSID: C9GowACHBggZnkJYyW4gIQ--.55469S3 X-Coremail-Antispam: 1Uf129KBjvJXoWrKr45WFW3Kw13XFW8WFW5trb_yoW8JrWkpr Wfu342yr1Y9FsYya1DAFsYy3s093Wftr9xWa1fu34rZrnxAFnYvF1YgF409rW5XFWkAFWa qrWUtr4UJF1DZa7anT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07b1WrJUUUUU= X-Originating-IP: [222.131.246.88] X-CM-SenderInfo: held01tdqsiiqw6rljoofrz/1tbiQBw1clSIRR59pQAAsE Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Function lbs_cmd_802_11_sleep_params() always return 0, even if the call to lbs_cmd_with_response() fails. In this case, the parameter @sp will keep uninitialized. Because the return value is 0, its caller (say lbs_sleepparams_read()) will not detect the error, and will copy the uninitialized stack memory to user sapce, resulting in stack information leak. To avoid the bug, this patch returns variable ret (which takes the return value of lbs_cmd_with_response()) instead of 0. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188451 Signed-off-by: Pan Bian --- drivers/net/wireless/marvell/libertas/cmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/marvell/libertas/cmd.c b/drivers/net/wireless/marvell/libertas/cmd.c index 301170c..033ff88 100644 --- a/drivers/net/wireless/marvell/libertas/cmd.c +++ b/drivers/net/wireless/marvell/libertas/cmd.c @@ -305,7 +305,7 @@ int lbs_cmd_802_11_sleep_params(struct lbs_private *priv, uint16_t cmd_action, } lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret); - return 0; + return ret; } static int lbs_wait_for_ds_awake(struct lbs_private *priv)