libertas: fix improper return value
authorPan Bian <bianpan2016@163.com>
Sat, 3 Dec 2016 10:27:37 +0000 (18:27 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Nov 2017 14:53:14 +0000 (15:53 +0100)
commit397b6e5d7bbe23ee8f0973b42fc273940e3bd0d1
treef610af848c6f9007b43a82141d9c8ed66dfad39b
parent2ae9f47ce114680dbbc2c56b00ed85eade4f6328
libertas: fix improper return value

[ Upstream commit 259010c509b6f28b3b851ae45238cf526f52e185 ]

Function lbs_cmd_802_11_sleep_params() always return 0, even if the call
to lbs_cmd_with_response() fails. In this case, the parameter @sp will
keep uninitialized. Because the return value is 0, its caller (say
lbs_sleepparams_read()) will not detect the error, and will copy the
uninitialized stack memory to user sapce, resulting in stack information
leak. To avoid the bug, this patch returns variable ret (which takes
the return value of lbs_cmd_with_response()) instead of 0.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188451

Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/wireless/marvell/libertas/cmd.c