| From foo@baz Thu Nov 9 09:48:01 CET 2017 |
| From: Pan Bian <bianpan2016@163.com> |
| Date: Sat, 3 Dec 2016 18:27:37 +0800 |
| Subject: libertas: fix improper return value |
| |
| From: Pan Bian <bianpan2016@163.com> |
| |
| |
| [ Upstream commit 259010c509b6f28b3b851ae45238cf526f52e185 ] |
| |
| Function lbs_cmd_802_11_sleep_params() always return 0, even if the call |
| to lbs_cmd_with_response() fails. In this case, the parameter @sp will |
| keep uninitialized. Because the return value is 0, its caller (say |
| lbs_sleepparams_read()) will not detect the error, and will copy the |
| uninitialized stack memory to user sapce, resulting in stack information |
| leak. To avoid the bug, this patch returns variable ret (which takes |
| the return value of lbs_cmd_with_response()) instead of 0. |
| |
| Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188451 |
| |
| Signed-off-by: Pan Bian <bianpan2016@163.com> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Signed-off-by: Sasha Levin <alexander.levin@verizon.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/wireless/marvell/libertas/cmd.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/net/wireless/marvell/libertas/cmd.c |
| +++ b/drivers/net/wireless/marvell/libertas/cmd.c |
| @@ -305,7 +305,7 @@ int lbs_cmd_802_11_sleep_params(struct l |
| } |
| |
| lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret); |
| - return 0; |
| + return ret; |
| } |
| |
| static int lbs_wait_for_ds_awake(struct lbs_private *priv) |