From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1035617AbdEXNo0 (ORCPT ); Wed, 24 May 2017 09:44:26 -0400 Received: from smtp.codeaurora.org ([198.145.29.96]:45972 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1763742AbdEXNoX (ORCPT ); Wed, 24 May 2017 09:44:23 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org C9F8260DD9 Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=kvalo@codeaurora.org Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: Re: [v3] libertas: Avoid reading past end of buffer From: Kalle Valo In-Reply-To: <20170515212640.GA45443@beast> References: <20170515212640.GA45443@beast> To: Kees Cook Cc: netdev@vger.kernel.org, Joe Perches , libertas-dev@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, Daniel Micay , linux-kernel@vger.kernel.org User-Agent: pwcli/0.0.0-git (https://github.com/kvalo/pwcli/) Python/2.7.12 Message-Id: <20170524134422.7230F60DD9@smtp.codeaurora.org> Date: Wed, 24 May 2017 13:44:22 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Kees Cook wrote: > Using memcpy() from a string that is shorter than the length copied means > the destination buffer is being filled with arbitrary data from the kernel > rodata segment. Instead, redefine the stat strings to be ETH_GSTRING_LEN > sizes, like other drivers. This lets us use a single memcpy that does not > leak rodata contents. Additionally adjust indentation to keep checkpatch.pl > happy. > > This was found with the future CONFIG_FORTIFY_SOURCE feature. > > Cc: Daniel Micay > Signed-off-by: Kees Cook Patch applied to wireless-drivers-next.git, thanks. 12e3c0433e8a libertas: Avoid reading past end of buffer -- https://patchwork.kernel.org/patch/9727997/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches