From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.6 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5E9CC74A2B for ; Wed, 10 Jul 2019 14:51:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id BEFD120645 for ; Wed, 10 Jul 2019 14:51:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1562770278; bh=p7Jhjq6FO2XopPND8g78jDlqt/nU529GHfEQLxCVxmA=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=jrMZuG2NA8dKZZDILREsDCpfhmscjqO3MgskZyaek0O/vyXyf/muIgnxwkFlpc342 r+NfKyB5YJ6Sznqx6ob4qQA9p364yieoO4gtu2vhWsEmtRwvSjJYdFazUszu1AHB7D +ATSxVJ4zPpepx7H1OkB425yUtNEqxcYc7qqooIk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727491AbfGJOvP (ORCPT ); Wed, 10 Jul 2019 10:51:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:56296 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726097AbfGJOvO (ORCPT ); Wed, 10 Jul 2019 10:51:14 -0400 Received: from localhost (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 10BFD20645; Wed, 10 Jul 2019 14:51:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1562770274; bh=p7Jhjq6FO2XopPND8g78jDlqt/nU529GHfEQLxCVxmA=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=y3hfs2UIuCn3gZLUiUGJX2cT6kqSe2EziKkuF3h+9PVpLG6CD11qX3VlJGq0JDFRe kscKHJKoSr6ylpXIcYOFqWUdqsR6uLoFrVJk37NTLJqxeXQBKwmx+fIBFq2bqwV+kV AS1xUwy47BU6795UGfu21t/U9kk9WUEYrsch3MnE= Date: Wed, 10 Jul 2019 10:51:12 -0400 From: Sasha Levin To: Brian Norris Cc: Linux Kernel , stable , Takashi Iwai , Kalle Valo , linux-wireless , "" Subject: Re: [PATCH AUTOSEL 4.19 14/60] mwifiex: Abort at too short BSS descriptor element Message-ID: <20190710145112.GX10104@sasha-vm> References: <20190627003616.20767-1-sashal@kernel.org> <20190627003616.20767-14-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Fri, Jun 28, 2019 at 03:58:49PM -0700, Brian Norris wrote: >On Wed, Jun 26, 2019 at 5:49 PM Sasha Levin wrote: >> >> From: Takashi Iwai >> >> [ Upstream commit 685c9b7750bfacd6fc1db50d86579980593b7869 ] >> >> Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that >> the source descriptor entries contain the enough size for each type >> and performs copying without checking the source size. This may lead >> to read over boundary. >> >> Fix this by putting the source size check in appropriate places. >> >> Signed-off-by: Takashi Iwai >> Signed-off-by: Kalle Valo >> Signed-off-by: Sasha Levin > >For the record, this fixup is still aiming for 5.2, correcting some >potential mistakes in this patch: > >63d7ef36103d mwifiex: Don't abort on small, spec-compliant vendor IEs > >So you might want to hold off a bit, and grab them both. I see that 63d7ef36103d didn't make it into 5.2, so I'll just drop this for now. -- Thanks, Sasha