From: Lee Jones <lee.jones@linaro.org>
To: gregkh@google.com
Cc: linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, Takashi Iwai <tiwai@suse.de>,
Kalle Valo <kvalo@codeaurora.org>,
Sasha Levin <sashal@kernel.org>, Lee Jones <lee.jones@linaro.org>
Subject: [PATCH 04/10] mwifiex: Abort at too short BSS descriptor element
Date: Thu, 7 Nov 2019 20:16:56 +0000 [thread overview]
Message-ID: <20191107201702.27023-4-lee.jones@linaro.org> (raw)
In-Reply-To: <20191107201702.27023-1-lee.jones@linaro.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 685c9b7750bfacd6fc1db50d86579980593b7869 ]
Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that
the source descriptor entries contain the enough size for each type
and performs copying without checking the source size. This may lead
to read over boundary.
Fix this by putting the source size check in appropriate places.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I8812db5f71b733e14573cacb6136e8a1a23036df
---
drivers/net/wireless/mwifiex/scan.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 81a50d8af370..cff755475bc0 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1296,6 +1296,9 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_VENDOR_SPECIFIC:
+ if (element_len + 2 < sizeof(vendor_ie->vend_hdr))
+ return -EINVAL;
+
vendor_ie = (struct ieee_types_vendor_specific *)
current_ptr;
--
2.24.0
next prev parent reply other threads:[~2019-11-07 20:17 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-07 20:16 [PATCH 01/10] ASoC: max98090: remove 24-bit format support if RJ is 0 Lee Jones
2019-11-07 20:16 ` [PATCH 02/10] usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC Lee Jones
2019-11-07 20:16 ` [PATCH 03/10] mac80211: mesh: fix RCU warning Lee Jones
2019-11-07 20:16 ` Lee Jones [this message]
2019-11-07 20:16 ` [PATCH 05/10] Input: imx_keypad - make sure keyboard can always wake up system Lee Jones
2019-11-07 20:16 ` [PATCH 06/10] ARM: davinci: da850-evm: call regulator_has_full_constraints() Lee Jones
2019-11-07 20:16 ` [PATCH 07/10] md: fix for divide error in status_resync Lee Jones
2019-11-07 20:17 ` [PATCH 08/10] bnx2x: Check if transceiver implements DDM before access Lee Jones
2019-11-07 20:17 ` [PATCH 09/10] ARM: davinci: da8xx: specify dma_coherent_mask for lcdc Lee Jones
2019-11-07 20:17 ` [PATCH 10/10] can: mcp251x: add support for mcp25625 Lee Jones
2019-11-08 7:42 ` [PATCH 01/10] ASoC: max98090: remove 24-bit format support if RJ is 0 Lee Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191107201702.27023-4-lee.jones@linaro.org \
--to=lee.jones@linaro.org \
--cc=gregkh@google.com \
--cc=kvalo@codeaurora.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).