diff for duplicates of <20200708115857.GA13729@mwanda> diff --git a/a/1.txt b/N1/1.txt index f910b8b..9892300 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -15,14 +15,15 @@ index f21660149f58..267b02cde30c 100644 +++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c @@ -580,6 +580,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, { - struct host_cmd_ds_802_11_key_material *key &resp->params.key_material; + struct host_cmd_ds_802_11_key_material *key = + &resp->params.key_material; + int len; + + len = le16_to_cpu(key->key_param_set.key_len); + if (len > sizeof(key->key_param_set.key)) + return -EINVAL; - if (le16_to_cpu(key->action) = HostCmd_ACT_GEN_SET) { + if (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) { if ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) { @@ -593,9 +598,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, @@ -49,13 +50,14 @@ index f21660149f58..267b02cde30c 100644 + if (len > WLAN_KEY_LEN_CCMP) + return -EINVAL; + - if (le16_to_cpu(key_v2->action) = HostCmd_ACT_GEN_SET) { + if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) { if ((le16_to_cpu(key_v2->key_param_set.key_info) & KEY_MCAST)) { mwifiex_dbg(priv->adapter, INFO, "info: key: GTK is set\n"); @@ -628,10 +637,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0, WLAN_KEY_LEN_CCMP); - priv->aes_key_v2.key_param_set.key_params.aes.key_len - key_v2->key_param_set.key_params.aes.key_len; + priv->aes_key_v2.key_param_set.key_params.aes.key_len = +- key_v2->key_param_set.key_params.aes.key_len; - len = priv->aes_key_v2.key_param_set.key_params.aes.key_len; + cpu_to_le16(len); memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key, diff --git a/a/content_digest b/N1/content_digest index 63d5217..55d84d2 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,6 +1,6 @@ "From\0Dan Carpenter <dan.carpenter@oracle.com>\0" "Subject\0[PATCH net-next] mwifiex: Prevent memory corruption handling keys\0" - "Date\0Wed, 08 Jul 2020 11:58:57 +0000\0" + "Date\0Wed, 8 Jul 2020 14:58:57 +0300\0" "To\0Amitkumar Karwar <amitkarwar@gmail.com>\0" "Cc\0Ganapathi Bhat <ganapathi.bhat@nxp.com>" Xinming Hu <huxinming820@gmail.com> @@ -32,14 +32,15 @@ "+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c\n" "@@ -580,6 +580,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv,\n" " {\n" - " \tstruct host_cmd_ds_802_11_key_material *key \t\t\t\t\t\t&resp->params.key_material;\n" + " \tstruct host_cmd_ds_802_11_key_material *key =\n" + " \t\t\t\t\t\t&resp->params.key_material;\n" "+\tint len;\n" "+\n" "+\tlen = le16_to_cpu(key->key_param_set.key_len);\n" "+\tif (len > sizeof(key->key_param_set.key))\n" "+\t\treturn -EINVAL;\n" " \n" - " \tif (le16_to_cpu(key->action) = HostCmd_ACT_GEN_SET) {\n" + " \tif (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) {\n" " \t\tif ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) {\n" "@@ -593,9 +598,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv,\n" " \n" @@ -66,13 +67,14 @@ "+\tif (len > WLAN_KEY_LEN_CCMP)\n" "+\t\treturn -EINVAL;\n" "+\n" - " \tif (le16_to_cpu(key_v2->action) = HostCmd_ACT_GEN_SET) {\n" + " \tif (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) {\n" " \t\tif ((le16_to_cpu(key_v2->key_param_set.key_info) & KEY_MCAST)) {\n" " \t\t\tmwifiex_dbg(priv->adapter, INFO, \"info: key: GTK is set\\n\");\n" "@@ -628,10 +637,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,\n" " \tmemset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0,\n" " \t WLAN_KEY_LEN_CCMP);\n" - " \tpriv->aes_key_v2.key_param_set.key_params.aes.key_len -\t\t\t\tkey_v2->key_param_set.key_params.aes.key_len;\n" + " \tpriv->aes_key_v2.key_param_set.key_params.aes.key_len =\n" + "-\t\t\t\tkey_v2->key_param_set.key_params.aes.key_len;\n" "-\tlen = priv->aes_key_v2.key_param_set.key_params.aes.key_len;\n" "+\t\t\t\tcpu_to_le16(len);\n" " \tmemcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,\n" @@ -84,4 +86,4 @@ "-- \n" 2.27.0 -915eae7ac860b5567f644f16f98540e1f60e6d60563f9429102bf12c47fc4246 +271fcd99f266fa7bdd17d077ab5dc47e4fa790b245f6cc99917001003b1719e7
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.