kernel/linux.git/net/wireless/wext-core.c, branch v6.18.22

wifi: avoid kernel-infoleak from struct iw_point

2026-01-17T15:35:14+00:00

commit 21cbf883d073abbfe09e3924466aa5e0449e7261 upstream. struct iw_point has a 32bit hole on 64bit arches. struct iw_point { void __user *pointer; /* Pointer to the data (in user space) */ __u16 length; /* number of fields or size in bytes */ __u16 flags; /* Optional params */ }; Make sure to zero the structure to avoid disclosing 32bits of kernel data to user space. Fixes: 87de87d5e47f ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c") Reported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman

net: s/dev_get_flags/netif_get_flags/

2025-07-19T00:27:47+00:00

Commit cc34acd577f1 ("docs: net: document new locking reality") introduced netif_ vs dev_ function semantics: the former expects locked netdev, the latter takes care of the locking. We don't strictly follow this semantics on either side, but there are more dev_xxx handlers now that don't fit. Rename them to netif_xxx where appropriate. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250717172333.1288349-6-sdf@fomichev.me Signed-off-by: Jakub Kicinski

net: remove get_task_comm() and print task comm directly

2025-01-13T04:21:16+00:00

Since task->comm is guaranteed to be NUL-terminated, we can print it directly without the need to copy it into a separate buffer. This simplifies the code and avoids unnecessary operations. Link: https://lkml.kernel.org/r/20241219023452.69907-4-laoar.shao@gmail.com Signed-off-by: Yafang Shao Cc: Johannes Berg Cc: "André Almeida" Cc: Andy Shevchenko Cc: Borislav Petkov (AMD) Cc: Danilo Krummrich Cc: Darren Hart Cc: Dave Hansen Cc: David Airlie Cc: Davidlohr Bueso Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Morris Cc: Jani Nikula Cc: Jiri Slaby Cc: Joonas Lahtinen Cc: Kalle Valo Cc: Karol Herbst Cc: Kees Cook Cc: Linus Torvalds Cc: Lyude Paul Cc: Oded Gabbay Cc: Paul Moore Cc: Peter Zijlstra Cc: Petr Mladek Cc: Rodrigo Vivi Cc: "Serge E. Hallyn" Cc: Simona Vetter Cc: Thomas Gleixner Cc: Tvrtko Ursulin Cc: Vineet Gupta Signed-off-by: Andrew Morton

Revert "wifi: cfg80211: unexport wireless_nlevent_flush()"

2024-10-09T06:53:01+00:00

Revert this, I neglected to take into account the fact that cfg80211 itself can be a module, but wext is always builtin. Fixes: aee809aaa2d1 ("wifi: cfg80211: unexport wireless_nlevent_flush()") Signed-off-by: Johannes Berg

wifi: cfg80211: unexport wireless_nlevent_flush()

2024-10-08T19:53:55+00:00

This no longer needs to be exported, so don't export it. Link: https://patch.msgid.link/20241007214715.3dd736dc3ac0.I1388536e99c37f28a007dd753c473ad21513d9a9@changeid Signed-off-by: Johannes Berg

wifi: mac80211, cfg80211: miscellaneous spelling fixes

2024-10-08T19:52:09+00:00

Correct spelling here and there as suggested by codespell. Signed-off-by: Dmitry Antipov Link: https://patch.msgid.link/20240913084919.118862-1-dmantipov@yandex.ru Signed-off-by: Johannes Berg

wifi: cfg80211: add a flag to disable wireless extensions

2024-03-25T14:23:06+00:00

Wireless extensions are already disabled if MLO is enabled, given that we cannot support MLO there with all the hard- coded assumptions about BSSID etc. However, the WiFi7 ecosystem is still stabilizing, and some devices may need MLO disabled while that happens. In that case, we might end up with a device that supports wext (but not MLO) in one kernel, and then breaks wext in the future (by enabling MLO), which is not desirable. Add a flag to let such drivers/devices disable wext even if MLO isn't yet enabled. Cc: stable@vger.kernel.org Link: https://msgid.link/20240314110951.b50f1dc4ec21.I656ddd8178eedb49dc5c6c0e70f8ce5807afb54f@changeid Signed-off-by: Johannes Berg

wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()

2023-06-19T10:05:27+00:00

-Wstringop-overflow is legitimately warning us about extra_size pontentially being zero at some point, hence potenially ending up _allocating_ zero bytes of memory for extra pointer and then trying to access such object in a call to copy_from_user(). Fix this by adding a sanity check to ensure we never end up trying to allocate zero bytes of data for extra pointer, before continue executing the rest of the code in the function. Address the following -Wstringop-overflow warning seen when built m68k architecture with allyesconfig configuration: from net/wireless/wext-core.c:11: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:183:7, inlined from 'ioctl_standard_iw_point' at net/wireless/wext-core.c:825:7: arch/m68k/include/asm/string.h:48:25: warning: '__builtin_memset' writing 1 or more bytes into a region of size 0 overflows the destination [-Wstringop-overflow=] 48 | #define memset(d, c, n) __builtin_memset(d, c, n) | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:153:17: note: in expansion of macro 'memset' 153 | memset(to + (n - res), 0, res); | ^~~~~~ In function 'kmalloc', inlined from 'kzalloc' at include/linux/slab.h:694:9, inlined from 'ioctl_standard_iw_point' at net/wireless/wext-core.c:819:10: include/linux/slab.h:577:16: note: at offset 1 into destination object of size 0 allocated by '__kmalloc' 577 | return __kmalloc(size, flags); | ^~~~~~~~~~~~~~~~~~~~~~ This help with the ongoing efforts to globally enable -Wstringop-overflow. Link: https://github.com/KSPP/linux/issues/315 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/ZItSlzvIpjdjNfd8@work Signed-off-by: Johannes Berg

wifi: wext: warn about usage only once

2023-02-26T17:53:35+00:00

Warn only once since the ratelimit parameters are still allowing too many messages to happen. This will no longer tell you all the different processes, but still gives a heads-up of sorts. Also modify the message to note that wext stops working for future Wi-Fi 7 hardware, this is already implemented in commit 4ca69027691a ("wifi: wireless: deny wireless extensions on MLO-capable devices") and is maybe of more relevance to users than the fact that we'd like to have wireless extensions deprecated. The issue with Wi-Fi 7 is that you can now have multiple connections to the same AP, so a whole bunch of things now become per link rather than per netdev, which can't really be handled in wireless extensions. Signed-off-by: Johannes Berg Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230224135933.94104aeda1a0.Ie771c6a66d7d6c3cf67da5f3b0c66cea66fd514c@changeid

wifi: wireless: deny wireless extensions on MLO-capable devices

2023-01-19T18:01:41+00:00

These are WiFi 7 devices that will be introduced into the market in 2023, with new drivers. Wireless extensions haven't been in real development since 2006. Since wireless has evolved a lot, and continues to evolve significantly with Multi-Link Operation, there's really no good way to still support wireless extensions for devices that do MLO. Stop supporting wireless extensions for new devices. We don't consider this a regression since no such devices (apart from hwsim) exist yet. Signed-off-by: Johannes Berg Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230118105152.45f85078a1e0.Ib9eabc2ec5bf6b0244e4d973e93baaa3d8c91bd8@changeid