Skip to content

Commit d6553b6

Browse files
committed
wifi: mac80211: clear frame buffer to never leak stack
JIRA: https://issues.redhat.com/browse/RHEL-114889 commit 8af596e Author: Johannes Berg <johannes.berg@intel.com> Date: Tue Jul 1 09:22:13 2025 +0200 wifi: mac80211: clear frame buffer to never leak stack In disconnect paths paths, local frame buffers are used to build deauthentication frames to send them over the air and as notifications to userspace. Some internal error paths (that, given no other bugs, cannot happen) don't always initialize the buffers before sending them to userspace, so in the presence of other bugs they can leak stack content. Initialize the buffers to avoid the possibility of this happening. Suggested-by: Zhongqiu Han <quic_zhonhan@quicinc.com> Link: https://patch.msgid.link/20250701072213.13004-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
1 parent 7a4303c commit d6553b6

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

net/mac80211/mlme.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3934,6 +3934,9 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
39343934

39353935
lockdep_assert_wiphy(local->hw.wiphy);
39363936

3937+
if (frame_buf)
3938+
memset(frame_buf, 0, IEEE80211_DEAUTH_FRAME_LEN);
3939+
39373940
if (WARN_ON(!ap_sta))
39383941
return;
39393942

0 commit comments

Comments
 (0)