diff options
| author | Kees Cook <keescook@chromium.org> | 2021-08-18 01:19:37 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-08-18 12:45:28 +0200 |
| commit | 0a9b92020d755c4c7a50c7b4b9a0fa047e393083 (patch) | |
| tree | aeba7c1d7d1547cfdd40b94ac2432f8c18b76d49 /drivers/staging/wlan-ng | |
| parent | cbe34165cc1b7d1110b268ba8b9f30843c941639 (diff) | |
staging: wlan-ng: Disable buggy MIB ioctl
struct hfa384x_wpa_data ends with a flexible array, but it is allocated
on the stack. This means it can never hold any data. Disable the
memcpy() calls in and out of the structure, since it must always be
zero. This could never have worked.
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Cc: linux-staging@lists.linux.dev
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210818081937.1668775-1-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/wlan-ng')
| -rw-r--r-- | drivers/staging/wlan-ng/prism2mib.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/staging/wlan-ng/prism2mib.c b/drivers/staging/wlan-ng/prism2mib.c index 875812a391c9..d14f032a7ed6 100644 --- a/drivers/staging/wlan-ng/prism2mib.c +++ b/drivers/staging/wlan-ng/prism2mib.c @@ -668,6 +668,10 @@ static int prism2mib_priv(struct mibrec *mib, switch (mib->did) { case DIDMIB_LNX_CONFIGTABLE_RSNAIE: { + /* + * This can never work: wpa is on the stack + * and has no bytes allocated in wpa.data. + */ struct hfa384x_wpa_data wpa; if (isget) { @@ -675,11 +679,17 @@ static int prism2mib_priv(struct mibrec *mib, HFA384x_RID_CNFWPADATA, (u8 *)&wpa, sizeof(wpa)); + /* pstr->len = le16_to_cpu(wpa.datalen); memcpy(pstr->data, wpa.data, pstr->len); + */ + pstr->len = 0; } else { + /* wpa.datalen = cpu_to_le16(pstr->len); memcpy(wpa.data, pstr->data, pstr->len); + */ + wpa.datalen = 0; hfa384x_drvr_setconfig(hw, HFA384x_RID_CNFWPADATA, |