Hello, Our UC-KLEE tool found an uninitialized memcpy length (segfault) bug in airo_get_essid (drivers/net/wireless/airo.c). We found the bug in kernel 3.16.3, but it appears to date back beyond the original kernel git commit in 2005 (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2). The offending code is as follows: 5912 readStatusRid(local, &status_rid, 1); 5913 5914 /* Note : if dwrq->flags != 0, we should 5915 * get the relevant SSID from the SSID list... */ 5916 5917 /* Get the current SSID */ 5918 memcpy(extra, status_rid.SSID, le16_to_cpu(status_rid.SSIDlen)); The call to readStatusRid() on line 5912 fails if PC4500_readrid() fails, which can happen if down_interruptible() fails (e.g., is interrupted). This leaves the ‘status_rid’ struct uninitialized. The memcpy() at line 5918 then uses garbage values from the stack as the memcpy length, which can corrupt memory or cause a kernel segfault. The recommended fix is to check the return value of readStatusRid() and return an error when it fails. Please let me know if you have any questions. Thanks, -David -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
