From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Zhang Xiaohui <ruc_zhangxiaohui@163.com>,
Kalle Valo <kvalo@codeaurora.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.19 8/8] mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start
Date: Thu, 7 Jan 2021 15:32:08 +0100 [thread overview]
Message-ID: <20210107143048.752377363@linuxfoundation.org> (raw)
In-Reply-To: <20210107143047.586006010@linuxfoundation.org>
From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
[ Upstream commit 5c455c5ab332773464d02ba17015acdca198f03d ]
mwifiex_cmd_802_11_ad_hoc_start() calls memcpy() without checking
the destination size may trigger a buffer overflower,
which a local user could use to cause denial of service
or the execution of arbitrary code.
Fix it by putting the length check before calling memcpy().
Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201206084801.26479-1-ruc_zhangxiaohui@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/join.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
index d87aeff70cefb..c2cb1e711c06e 100644
--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -877,6 +877,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
+ if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
+ req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",
--
2.27.0
next prev parent reply other threads:[~2021-01-07 14:37 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-07 14:32 [PATCH 4.19 0/8] 4.19.166-rc1 review Greg Kroah-Hartman
2021-01-07 14:32 ` [PATCH 4.19 1/8] Revert "mtd: spinand: Fix OOB read" Greg Kroah-Hartman
2021-01-07 14:32 ` [PATCH 4.19 2/8] dmaengine: at_hdmac: Substitute kzalloc with kmalloc Greg Kroah-Hartman
2021-01-07 14:32 ` [PATCH 4.19 3/8] dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate() Greg Kroah-Hartman
2021-01-07 14:32 ` [PATCH 4.19 4/8] dmaengine: at_hdmac: add missing kfree() " Greg Kroah-Hartman
2021-01-07 14:32 ` [PATCH 4.19 5/8] kdev_t: always inline major/minor helper functions Greg Kroah-Hartman
2021-01-07 14:32 ` [PATCH 4.19 6/8] iio:imu:bmi160: Fix alignment and data leak issues Greg Kroah-Hartman
2021-01-07 14:32 ` [PATCH 4.19 7/8] iio:magnetometer:mag3110: " Greg Kroah-Hartman
2021-01-07 14:32 ` Greg Kroah-Hartman [this message]
2021-01-07 17:58 ` [PATCH 4.19 0/8] 4.19.166-rc1 review Pavel Machek
2021-01-09 12:44 ` Greg Kroah-Hartman
2021-01-07 20:20 ` Jon Hunter
2021-01-08 1:10 ` Shuah Khan
2021-01-08 2:44 ` Naresh Kamboju
2021-01-08 17:39 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210107143048.752377363@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ruc_zhangxiaohui@163.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.