Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

libertas: fix improper return value

Function lbs_cmd_802_11_sleep_params() always return 0, even if the call
to lbs_cmd_with_response() fails. In this case, the parameter @sp will
keep uninitialized. Because the return value is 0, its caller (say
lbs_sleepparams_read()) will not detect the error, and will copy the
uninitialized stack memory to user sapce, resulting in stack information
leak. To avoid the bug, this patch returns variable ret (which takes
the return value of lbs_cmd_with_response()) instead of 0.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188451

Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

authored by

Pan Bian and committed by
Kalle Valo
259010c5 7f2f6137

+1 -1
+1 -1
drivers/net/wireless/marvell/libertas/cmd.c
··· 305 305 } 306 306 307 307 lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret); 308 - return 0; 308 + return ret; 309 309 } 310 310 311 311 static int lbs_wait_for_ds_awake(struct lbs_private *priv)