On Thu, 2026-01-08 at 10:19 +0000, Eric Dumazet wrote:
struct iw_point has a 32bit hole on 64bit arches.
struct iw_point { void __user *pointer; /* Pointer to the data (in user space) */ __u16 length; /* number of fields or size in bytes */ __u16 flags; /* Optional params */ };
Make sure to zero the structure to avoid dislosing 32bits of kernel data to user space.
Heh, wow. Talk about old code.
Reported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/...
Was that intentionally without Link: or some other tag?
johannes