[PATCH] Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME

[PATCH] Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME

[Dan Aloni]

I repeatedly get __stack_chk_fail panic()s with this driver before
applying the attached fix.

ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.

    length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17

This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.

It can be applied to 2.6.30-stable as well.

Signed-off-by: Dan Aloni <dan@aloni.org>
---
 .../rtl8187se/ieee80211/ieee80211_softmac_wx.c     |   12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
index 93af37e..54b4b71 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
@@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee,
 			     struct iw_request_info *info,
 			     union iwreq_data *wrqu, char *extra)
 {
-	strcpy(wrqu->name, "802.11");
+	strlcpy(wrqu->name, "802.11", IFNAMSIZ);
 	if(ieee->modulation & IEEE80211_CCK_MODULATION){
-		strcat(wrqu->name, "b");
+		strlcat(wrqu->name, "b", IFNAMSIZ);
 		if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-			strcat(wrqu->name, "/g");
+			strlcat(wrqu->name, "/g", IFNAMSIZ);
 	}else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-		strcat(wrqu->name, "g");
+		strlcat(wrqu->name, "g", IFNAMSIZ);
 
 	if((ieee->state == IEEE80211_LINKED) ||
 		(ieee->state == IEEE80211_LINKED_SCANNING))
-		strcat(wrqu->name," linked");
+		strlcat(wrqu->name,"  link", IFNAMSIZ);
 	else if(ieee->state != IEEE80211_NOLINK)
-		strcat(wrqu->name," link..");
+		strlcat(wrqu->name," .....", IFNAMSIZ);
 
 
 	return 0;
-- 
1.6.0.4

Re: [PATCH] Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME

[Bartlomiej Zolnierkiewicz]

On Saturday 20 June 2009 15:32:22 Dan Aloni wrote:
> I repeatedly get __stack_chk_fail panic()s with this driver before
> applying the attached fix.
> 
> ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
> on certain conditions, the concatenated string will be larger than IFNAMSIZ
> including the terminating zero.
> 
>     length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17
> 
> This fix uses strl{cpy,cat} in addition to the reduction of the total
> possible length of the output string by a char.
> 
> It can be applied to 2.6.30-stable as well.

Recently added rtl8192su driver seems to also need it, care to port the fix?
(http://patchwork.kernel.org/patch/29630/ is needed to build rtl8192su ATM)

[PATCH] prevent rtl8192su from crashing dev_ioctl in SIOCGIWNAME

[Dan Aloni]

(adapted from the rtl8187se patch)

ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.

    length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17

This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.

It can be applied to 2.6.30-stable as well.

Signed-off-by: Dan Aloni <dan@aloni.org>
---
 .../rtl8192su/ieee80211/ieee80211_softmac_wx.c     |   14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
index 1f50c46..b93ddc9 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
@@ -548,21 +548,21 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee,
 			     struct iw_request_info *info,
 			     union iwreq_data *wrqu, char *extra)
 {
-	strcpy(wrqu->name, "802.11");
+	strlcpy(wrqu->name, "802.11", IFNAMSIZ);
 	if(ieee->modulation & IEEE80211_CCK_MODULATION){
-		strcat(wrqu->name, "b");
+		strlcat(wrqu->name, "b", IFNAMSIZ);
 		if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-			strcat(wrqu->name, "/g");
+			strlcat(wrqu->name, "/g", IFNAMSIZ);
 	}else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-		strcat(wrqu->name, "g");
+		strlcat(wrqu->name, "g", IFNAMSIZ);
 	if (ieee->mode & (IEEE_N_24G | IEEE_N_5G))
-		strcat(wrqu->name, "/n");
+		strlcat(wrqu->name, "/n", IFNAMSIZ);
 
 	if((ieee->state == IEEE80211_LINKED) ||
 		(ieee->state == IEEE80211_LINKED_SCANNING))
-		strcat(wrqu->name," linked");
+		strlcat(wrqu->name,"  link", IFNAMSIZ);
 	else if(ieee->state != IEEE80211_NOLINK)
-		strcat(wrqu->name," link..");
+		strlcat(wrqu->name," .....", IFNAMSIZ);
 
 
 	return 0;
-- 
1.6.0.4

Re: [PATCH] prevent rtl8192su from crashing dev_ioctl in SIOCGIWNAME

[Bartlomiej Zolnierkiewicz]

On Wednesday 24 June 2009 21:34:39 Dan Aloni wrote:
> (adapted from the rtl8187se patch)
> 
> ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
> on certain conditions, the concatenated string will be larger than IFNAMSIZ
> including the terminating zero.
> 
>     length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17
> 
> This fix uses strl{cpy,cat} in addition to the reduction of the total
> possible length of the output string by a char.
> 
> It can be applied to 2.6.30-stable as well.
> 
> Signed-off-by: Dan Aloni <dan@aloni.org>

Thanks!

I fixed some minor whitespace issues:

ERROR: space required after that ',' (ctx:VxV)                                                      
#50: FILE: drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c:563:                          
+               strlcat(wrqu->name,"  link", IFNAMSIZ);                                             
                                  ^                                                                 

ERROR: space required after that ',' (ctx:VxV)
#53: FILE: drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c:565:
+               strlcat(wrqu->name," .....", IFNAMSIZ);                   

and applied it to rtl8192su branch of my misc.git tree (just to keep it
together with other rtl8192su changes and not forget about this fix):

	git://git.kernel.org:/pub/scm/linux/kernel/git/bart/misc.git rtl8192su

Greg, here is the final version of the patch:

Date: Wed, 24 Jun 2009 22:34:39 +0300
From: Dan Aloni <dan@aloni.org>
Subject: [PATCH] Staging: prevent rtl8192su from crashing dev_ioctl in SIOCGIWNAME

(adapted from the rtl8187se patch)

ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.

    length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17

This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.

Signed-off-by: Dan Aloni <dan@aloni.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
---
 .../rtl8192su/ieee80211/ieee80211_softmac_wx.c     |   14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
index 1f50c46..b93ddc9 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
@@ -548,21 +548,21 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee,
 			     struct iw_request_info *info,
 			     union iwreq_data *wrqu, char *extra)
 {
-	strcpy(wrqu->name, "802.11");
+	strlcpy(wrqu->name, "802.11", IFNAMSIZ);
 	if(ieee->modulation & IEEE80211_CCK_MODULATION){
-		strcat(wrqu->name, "b");
+		strlcat(wrqu->name, "b", IFNAMSIZ);
 		if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-			strcat(wrqu->name, "/g");
+			strlcat(wrqu->name, "/g", IFNAMSIZ);
 	}else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-		strcat(wrqu->name, "g");
+		strlcat(wrqu->name, "g", IFNAMSIZ);
 	if (ieee->mode & (IEEE_N_24G | IEEE_N_5G))
-		strcat(wrqu->name, "/n");
+		strlcat(wrqu->name, "/n", IFNAMSIZ);
 
 	if((ieee->state == IEEE80211_LINKED) ||
 		(ieee->state == IEEE80211_LINKED_SCANNING))
-		strcat(wrqu->name," linked");
+		strlcat(wrqu->name, "  link", IFNAMSIZ);
 	else if(ieee->state != IEEE80211_NOLINK)
-		strcat(wrqu->name," link..");
+		strlcat(wrqu->name, " .....", IFNAMSIZ);
 
 
 	return 0;
-- 
1.6.0.4