From: Johannes Berg <johannes@sipsolutions.net>
To: David Miller <davem@davemloft.net>
Cc: daniel@caiaq.de, linux-kernel@vger.kernel.org, dcbw@redhat.com,
m.hirsch@raumfeld.com, netdev@vger.kernel.org,
libertas-dev@lists.infradead.org, stable@kernel.org,
linux-wireless@vger.kernel.org
Subject: Re: [PATCH] wireless: wext: allocate space for NULL-termination for 32byte SSIDs
Date: Tue, 15 Dec 2009 11:05:33 +0100 [thread overview]
Message-ID: <1260871533.3692.5.camel@johannes.local> (raw)
In-Reply-To: <1260871411.3692.4.camel@johannes.local>
[-- Attachment #1: Type: text/plain, Size: 910 bytes --]
On Tue, 2009-12-15 at 11:03 +0100, Johannes Berg wrote:
> On Tue, 2009-12-15 at 01:43 -0800, David Miller wrote:
>
> > > The effect is that after a number of mode transistions (sometimes as few
> > > as two sufficed), the kernel will oops at very strange locations, mostly
> > > in something like __kmem_alloc().
> > >
> > > While the root cause turned out to be an issue with the wpa-supplicant
> > > which feeds the kernel driver with garbage, this occasion pointed out a
> > > bug in the wireless wext core when SSIDs with 32 byte lengths are passed
> > > from userspace. In this case, the string is not properly NULL-terminated
> > > which causes some other part to corrupt memory.
And, I forgot to mention, this is in fact not an issue or the "root
cause" of any issues -- it's completely intentional that wpa_supplicant
feeds the kernel with a random, valid, 32-byte SSID.
johannes
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 801 bytes --]
next prev parent reply other threads:[~2009-12-15 10:05 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-12-12 20:47 [PATCH] wireless: wext: allocate space for NULL-termination for 32byte SSIDs Daniel Mack
2009-12-15 9:43 ` David Miller
2009-12-15 10:03 ` Johannes Berg
2009-12-15 10:05 ` Johannes Berg [this message]
2009-12-15 10:07 ` Johannes Berg
[not found] ` <1260871634.3692.6.camel-YfaajirXv2244ywRPIzf9A@public.gmane.org>
2009-12-15 10:20 ` Daniel Mack
[not found] ` <20091215102035.GJ28375-ahpEBR4enfnCULTFXS99ULNAH6kLmebB@public.gmane.org>
2009-12-15 10:31 ` Johannes Berg
2009-12-15 10:37 ` Daniel Mack
2009-12-15 10:30 ` Holger Schurig
[not found] ` <200912151130.59103.holgerschurig-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2009-12-15 10:35 ` Johannes Berg
2009-12-16 6:54 ` Albert Cahalan
2009-12-16 8:19 ` Johannes Berg
2009-12-16 8:26 ` Holger Schurig
2009-12-16 3:58 ` Daniel Mack
2009-12-16 8:20 ` Johannes Berg
2009-12-15 10:16 ` Albert Cahalan
2009-12-15 16:29 ` Marcel Holtmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1260871533.3692.5.camel@johannes.local \
--to=johannes@sipsolutions.net \
--cc=daniel@caiaq.de \
--cc=davem@davemloft.net \
--cc=dcbw@redhat.com \
--cc=libertas-dev@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=m.hirsch@raumfeld.com \
--cc=netdev@vger.kernel.org \
--cc=stable@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).