* [PATCH] mwifiex: printk() overflow with 32-byte SSIDs
@ 2016-11-09 2:28 Brian Norris
2016-11-09 7:51 ` Amitkumar Karwar
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Brian Norris @ 2016-11-09 2:28 UTC (permalink / raw)
To: Amitkumar Karwar, Nishant Sarmukadam, Kalle Valo
Cc: linux-kernel, linux-wireless, Cathy Luo, security, stable, Brian Norris
SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
when we print them out.
This can be easily noticed by connecting to a network with a 32-octet
SSID:
[ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to
'0123456789abcdef0123456789abcdef <uninitialized mem>' bssid
xx:xx:xx:xx:xx:xx
Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Cc: <stable@vger.kernel.org>
---
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 39ce76ad00bc..16241d21727b 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -2222,8 +2222,9 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len,
is_scanning_required = 1;
} else {
mwifiex_dbg(priv->adapter, MSG,
- "info: trying to associate to '%s' bssid %pM\n",
- (char *)req_ssid.ssid, bss->bssid);
+ "info: trying to associate to '%.*s' bssid %pM\n",
+ req_ssid.ssid_len, (char *)req_ssid.ssid,
+ bss->bssid);
memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN);
break;
}
@@ -2283,8 +2284,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
}
mwifiex_dbg(adapter, INFO,
- "info: Trying to associate to %s and bssid %pM\n",
- (char *)sme->ssid, sme->bssid);
+ "info: Trying to associate to %.*s and bssid %pM\n",
+ (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
if (!mwifiex_stop_bg_scan(priv))
cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
@@ -2417,8 +2418,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
}
mwifiex_dbg(priv->adapter, MSG,
- "info: trying to join to %s and bssid %pM\n",
- (char *)params->ssid, params->bssid);
+ "info: trying to join to %.*s and bssid %pM\n",
+ params->ssid_len, (char *)params->ssid, params->bssid);
mwifiex_set_ibss_params(priv, params);
--
2.8.0.rc3.226.g39d4020
^ permalink raw reply related [flat|nested] 5+ messages in thread
* RE: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs
2016-11-09 2:28 [PATCH] mwifiex: printk() overflow with 32-byte SSIDs Brian Norris
@ 2016-11-09 7:51 ` Amitkumar Karwar
2016-11-09 22:20 ` Kalle Valo
2016-11-17 11:18 ` Kalle Valo
2 siblings, 0 replies; 5+ messages in thread
From: Amitkumar Karwar @ 2016-11-09 7:51 UTC (permalink / raw)
To: Brian Norris, Nishant Sarmukadam, Kalle Valo
Cc: linux-kernel, linux-wireless, Cathy Luo, security, stable
> From: Brian Norris [mailto:briannorris@chromium.org]
> Sent: Wednesday, November 09, 2016 7:58 AM
> To: Amitkumar Karwar; Nishant Sarmukadam; Kalle Valo
> Cc: linux-kernel@vger.kernel.org; linux-wireless@vger.kernel.org; Cathy
> Luo; security@kernel.org; stable@vger.kernel.org; Brian Norris
> Subject: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs
>
> SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
> when we print them out.
>
> This can be easily noticed by connecting to a network with a 32-octet
> SSID:
>
> [ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to
> '0123456789abcdef0123456789abcdef <uninitialized mem>' bssid
> xx:xx:xx:xx:xx:xx
>
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell
> mwifiex driver")
> Signed-off-by: Brian Norris <briannorris@chromium.org>
> Cc: <stable@vger.kernel.org>
> ---
> drivers/net/wireless/marvell/mwifiex/cfg80211.c | 13 +++++++------
> 1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> index 39ce76ad00bc..16241d21727b 100644
> --- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> +++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> @@ -2222,8 +2222,9 @@ mwifiex_cfg80211_assoc(struct mwifiex_private
> *priv, size_t ssid_len,
> is_scanning_required = 1;
> } else {
> mwifiex_dbg(priv->adapter, MSG,
> - "info: trying to associate to '%s' bssid
> %pM\n",
> - (char *)req_ssid.ssid, bss->bssid);
> + "info: trying to associate to '%.*s' bssid
> %pM\n",
> + req_ssid.ssid_len, (char *)req_ssid.ssid,
> + bss->bssid);
> memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN);
> break;
> }
> @@ -2283,8 +2284,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy,
> struct net_device *dev,
> }
>
> mwifiex_dbg(adapter, INFO,
> - "info: Trying to associate to %s and bssid %pM\n",
> - (char *)sme->ssid, sme->bssid);
> + "info: Trying to associate to %.*s and bssid %pM\n",
> + (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
>
> if (!mwifiex_stop_bg_scan(priv))
> cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
> @@ -2417,8 +2418,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy,
> struct net_device *dev,
> }
>
> mwifiex_dbg(priv->adapter, MSG,
> - "info: trying to join to %s and bssid %pM\n",
> - (char *)params->ssid, params->bssid);
> + "info: trying to join to %.*s and bssid %pM\n",
> + params->ssid_len, (char *)params->ssid, params->bssid);
>
> mwifiex_set_ibss_params(priv, params);
>
> --
> 2.8.0.rc3.226.g39d4020
Thanks for fixing this.
Acked-by: Amitkumar Karwar <akarwar@marvell.com>
Regards,
Amitkumar
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs
2016-11-09 2:28 [PATCH] mwifiex: printk() overflow with 32-byte SSIDs Brian Norris
2016-11-09 7:51 ` Amitkumar Karwar
@ 2016-11-09 22:20 ` Kalle Valo
2016-11-09 22:22 ` Brian Norris
2016-11-17 11:18 ` Kalle Valo
2 siblings, 1 reply; 5+ messages in thread
From: Kalle Valo @ 2016-11-09 22:20 UTC (permalink / raw)
To: Brian Norris
Cc: Amitkumar Karwar, Nishant Sarmukadam, linux-kernel,
linux-wireless, Cathy Luo, security, stable
Brian Norris <briannorris@chromium.org> writes:
> SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
> when we print them out.
>
> This can be easily noticed by connecting to a network with a 32-octet
> SSID:
>
> [ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to
> '0123456789abcdef0123456789abcdef <uninitialized mem>' bssid
> xx:xx:xx:xx:xx:xx
>
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
> Signed-off-by: Brian Norris <briannorris@chromium.org>
> Cc: <stable@vger.kernel.org>
I'm planning to push this to 4.9 if no objections.
--
Kalle Valo
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs
2016-11-09 22:20 ` Kalle Valo
@ 2016-11-09 22:22 ` Brian Norris
0 siblings, 0 replies; 5+ messages in thread
From: Brian Norris @ 2016-11-09 22:22 UTC (permalink / raw)
To: Kalle Valo
Cc: Amitkumar Karwar, Nishant Sarmukadam, linux-kernel,
linux-wireless, Cathy Luo, security, stable
On Thu, Nov 10, 2016 at 12:20:53AM +0200, Kalle Valo wrote:
> Brian Norris <briannorris@chromium.org> writes:
>
> > SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
> > when we print them out.
> >
> > This can be easily noticed by connecting to a network with a 32-octet
> > SSID:
> >
> > [ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to
> > '0123456789abcdef0123456789abcdef <uninitialized mem>' bssid
> > xx:xx:xx:xx:xx:xx
> >
> > Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
> > Signed-off-by: Brian Norris <briannorris@chromium.org>
> > Cc: <stable@vger.kernel.org>
>
> I'm planning to push this to 4.9 if no objections.
SGTM. Thanks.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: mwifiex: printk() overflow with 32-byte SSIDs
2016-11-09 2:28 [PATCH] mwifiex: printk() overflow with 32-byte SSIDs Brian Norris
2016-11-09 7:51 ` Amitkumar Karwar
2016-11-09 22:20 ` Kalle Valo
@ 2016-11-17 11:18 ` Kalle Valo
2 siblings, 0 replies; 5+ messages in thread
From: Kalle Valo @ 2016-11-17 11:18 UTC (permalink / raw)
To: Brian Norris
Cc: Amitkumar Karwar, Nishant Sarmukadam, linux-kernel,
linux-wireless, Cathy Luo, security, stable, Brian Norris
Brian Norris <briannorris@chromium.org> wrote:
> SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
> when we print them out.
>
> This can be easily noticed by connecting to a network with a 32-octet
> SSID:
>
> [ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to
> '0123456789abcdef0123456789abcdef <uninitialized mem>' bssid
> xx:xx:xx:xx:xx:xx
>
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
> Signed-off-by: Brian Norris <briannorris@chromium.org>
> Cc: <stable@vger.kernel.org>
> Acked-by: Amitkumar Karwar <akarwar@marvell.com>
Patch applied to wireless-drivers.git, thanks.
fcd2042e8d36 mwifiex: printk() overflow with 32-byte SSIDs
--
https://patchwork.kernel.org/patch/9418369/
Documentation about submitting wireless patches and checking status
from patchwork:
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-11-17 11:18 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-11-09 2:28 [PATCH] mwifiex: printk() overflow with 32-byte SSIDs Brian Norris
2016-11-09 7:51 ` Amitkumar Karwar
2016-11-09 22:20 ` Kalle Valo
2016-11-09 22:22 ` Brian Norris
2016-11-17 11:18 ` Kalle Valo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.