Uninitialized memcpy length (segfault) in airo_get_essid (drivers/net/wireless/airo.c)

Uninitialized memcpy length (segfault) in airo_get_essid (drivers/net/wireless/airo.c)

[David Ramos]

Hello,

Our UC-KLEE tool found an uninitialized memcpy length (segfault) bug in airo_get_essid (drivers/net/wireless/airo.c). We found the bug in kernel 3.16.3, but it appears to date back beyond the original kernel git commit in 2005 (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2).

The offending code is as follows:

5912   readStatusRid(local, &status_rid, 1);
5913
5914   /* Note : if dwrq->flags != 0, we should                                                                                                                                                    
5915    * get the relevant SSID from the SSID list... */
5916
5917   /* Get the current SSID */
5918   memcpy(extra, status_rid.SSID, le16_to_cpu(status_rid.SSIDlen));

The call to readStatusRid() on line 5912 fails if PC4500_readrid() fails, which can happen if down_interruptible() fails (e.g., is interrupted). This leaves the ‘status_rid’ struct uninitialized. The memcpy() at line 5918 then uses garbage values from the stack as the memcpy length, which can corrupt memory or cause a kernel segfault.

The recommended fix is to check the return value of readStatusRid() and return an error when it fails.

Please let me know if you have any questions.

Thanks,
-David