From: walter harms <wharms@bfs.de>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>,
"John W. Linville" <linville@tuxdriver.com>,
linux-wireless@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [patch 1/4] rndis_wlan: integer overflows in rndis_wlan_do_link_up_work()
Date: Wed, 29 Feb 2012 08:21:29 +0000 [thread overview]
Message-ID: <4F4DE009.7010808@bfs.de> (raw)
In-Reply-To: <20120229063555.GC18031@elgon.mountain>
Am 29.02.2012 07:35, schrieb Dan Carpenter:
> If "offset" is negative then we can get past this check:
> if (offset > CONTROL_BUFFER_SIZE)
> Or if we pick a very high "req_ie_len" then we can get around the check:
> if (offset + req_ie_len > CONTROL_BUFFER_SIZE)
>
> I made "resp_ie_len" and "req_ie_len" unsigned. I don't know if it was
> intentional that they were signed in the original.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
> index a330c69..6d8a986 100644
> --- a/drivers/net/wireless/rndis_wlan.c
> +++ b/drivers/net/wireless/rndis_wlan.c
> @@ -2755,9 +2755,10 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
> struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
> struct ndis_80211_assoc_info *info = NULL;
> u8 bssid[ETH_ALEN];
> - int resp_ie_len, req_ie_len;
> + unsigned int resp_ie_len, req_ie_len;
> + unsigned int offset;
> u8 *req_ie, *resp_ie;
> - int ret, offset;
> + int ret;
> bool roamed = false;
> bool match_bss;
>
> @@ -2785,6 +2786,8 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
> ret = get_association_info(usbdev, info, CONTROL_BUFFER_SIZE);
> if (!ret) {
> req_ie_len = le32_to_cpu(info->req_ie_length);
> + if (req_ie_len > CONTROL_BUFFER_SIZE)
> + req_ie_len = CONTROL_BUFFER_SIZE;
> if (req_ie_len > 0) {
> offset = le32_to_cpu(info->offset_req_ies);
>
> @@ -2799,6 +2802,8 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
> }
>
> resp_ie_len = le32_to_cpu(info->resp_ie_length);
> + if (resp_ie_len > CONTROL_BUFFER_SIZE)
> + resp_ie_len = CONTROL_BUFFER_SIZE;
> if (resp_ie_len > 0) {
> offset = le32_to_cpu(info->offset_resp_ies);
>
hi dan,
the check below "if (resp_ie_len > 0)" looks strange for an unsigned.
re,
wh
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
>
WARNING: multiple messages have this Message-ID (diff)
From: walter harms <wharms@bfs.de>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>,
"John W. Linville" <linville@tuxdriver.com>,
linux-wireless@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [patch 1/4] rndis_wlan: integer overflows in rndis_wlan_do_link_up_work()
Date: Wed, 29 Feb 2012 09:21:29 +0100 [thread overview]
Message-ID: <4F4DE009.7010808@bfs.de> (raw)
In-Reply-To: <20120229063555.GC18031@elgon.mountain>
Am 29.02.2012 07:35, schrieb Dan Carpenter:
> If "offset" is negative then we can get past this check:
> if (offset > CONTROL_BUFFER_SIZE)
> Or if we pick a very high "req_ie_len" then we can get around the check:
> if (offset + req_ie_len > CONTROL_BUFFER_SIZE)
>
> I made "resp_ie_len" and "req_ie_len" unsigned. I don't know if it was
> intentional that they were signed in the original.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
> index a330c69..6d8a986 100644
> --- a/drivers/net/wireless/rndis_wlan.c
> +++ b/drivers/net/wireless/rndis_wlan.c
> @@ -2755,9 +2755,10 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
> struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
> struct ndis_80211_assoc_info *info = NULL;
> u8 bssid[ETH_ALEN];
> - int resp_ie_len, req_ie_len;
> + unsigned int resp_ie_len, req_ie_len;
> + unsigned int offset;
> u8 *req_ie, *resp_ie;
> - int ret, offset;
> + int ret;
> bool roamed = false;
> bool match_bss;
>
> @@ -2785,6 +2786,8 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
> ret = get_association_info(usbdev, info, CONTROL_BUFFER_SIZE);
> if (!ret) {
> req_ie_len = le32_to_cpu(info->req_ie_length);
> + if (req_ie_len > CONTROL_BUFFER_SIZE)
> + req_ie_len = CONTROL_BUFFER_SIZE;
> if (req_ie_len > 0) {
> offset = le32_to_cpu(info->offset_req_ies);
>
> @@ -2799,6 +2802,8 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
> }
>
> resp_ie_len = le32_to_cpu(info->resp_ie_length);
> + if (resp_ie_len > CONTROL_BUFFER_SIZE)
> + resp_ie_len = CONTROL_BUFFER_SIZE;
> if (resp_ie_len > 0) {
> offset = le32_to_cpu(info->offset_resp_ies);
>
hi dan,
the check below "if (resp_ie_len > 0)" looks strange for an unsigned.
re,
wh
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
>
next prev parent reply other threads:[~2012-02-29 8:21 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-02-29 6:35 [patch 1/4] rndis_wlan: integer overflows in rndis_wlan_do_link_up_work() Dan Carpenter
2012-02-29 6:35 ` Dan Carpenter
2012-02-29 8:21 ` walter harms [this message]
2012-02-29 8:21 ` walter harms
2012-03-01 6:58 ` Dan Carpenter
2012-03-01 6:58 ` Dan Carpenter
2012-03-01 7:02 ` [patch 1/4 v2] " Dan Carpenter
2012-03-01 7:02 ` Dan Carpenter
2012-03-01 9:51 ` bojan prtvar
2012-03-01 9:51 ` bojan prtvar
2012-03-01 12:57 ` Dan Carpenter
2012-03-01 12:57 ` Dan Carpenter
2012-03-01 10:19 ` [patch 1/4] " Jussi Kivilinna
2012-03-01 10:19 ` Jussi Kivilinna
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F4DE009.7010808@bfs.de \
--to=wharms@bfs.de \
--cc=dan.carpenter@oracle.com \
--cc=jussi.kivilinna@mbnet.fi \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.