From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Zhang Xiaohui <ruc_zhangxiaohui@163.com>,
Kalle Valo <kvalo@codeaurora.org>,
Sasha Levin <sashal@kernel.org>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.4 31/38] mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start
Date: Tue, 22 Dec 2020 21:25:09 -0500 [thread overview]
Message-ID: <20201223022516.2794471-31-sashal@kernel.org> (raw)
In-Reply-To: <20201223022516.2794471-1-sashal@kernel.org>
From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
[ Upstream commit 5c455c5ab332773464d02ba17015acdca198f03d ]
mwifiex_cmd_802_11_ad_hoc_start() calls memcpy() without checking
the destination size may trigger a buffer overflower,
which a local user could use to cause denial of service
or the execution of arbitrary code.
Fix it by putting the length check before calling memcpy().
Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201206084801.26479-1-ruc_zhangxiaohui@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mwifiex/join.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 6378dfd3b4e86..83b7cd5bdf930 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -856,6 +856,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
+ if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
+ req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",
--
2.27.0
next prev parent reply other threads:[~2020-12-23 2:27 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20201223022516.2794471-1-sashal@kernel.org>
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 03/38] staging: wimax: depends on NET Sasha Levin
2020-12-23 2:38 ` Jakub Kicinski
2020-12-23 14:14 ` Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 11/38] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 12/38] net: skb_vlan_untag(): don't reset transport offset if set by GRO layer Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 21/38] rxrpc: Don't leak the service-side session key to userspace Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 25/38] brcmsmac: ampdu: Check BA window size before checking block ack Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 29/38] net/lapb: fix t1 timer handling for LAPB_STATE_0 Sasha Levin
2020-12-23 2:25 ` Sasha Levin [this message]
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 33/38] iwlwifi: trans: consider firmware dead after errors Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 34/38] iwlwifi: add an extra firmware state in the transport Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 35/38] mac80211: disallow band-switch during CSA Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 36/38] mac80211: don't filter out beacons once we start CSA Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201223022516.2794471-31-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=ruc_zhangxiaohui@163.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).