Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea5287d8 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: ks7010: prevent buffer overflow in ks_wlan_set_scan() 



commit e163b9823a0b08c3bb8dc4f5b4b5c221c24ec3e5 upstream.

The user can specify a "req->essid_len" of up to 255 but if it's
over IW_ESSID_MAX_SIZE (32) that can lead to memory corruption.

Fixes: 13a9930d ("staging: ks7010: add driver from Nanonote extra-repository")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/YD4fS8+HmM/Qmrw6@mwanda


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ff985202

drivers/staging/ks7010/ks_wlan_net.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -1404,6 +1404,7 @@ static int ks_wlan_set_scan(struct net_device *dev, 
	struct ks_wlan_private *priv =

	struct ks_wlan_private *priv =

	    (struct ks_wlan_private *)netdev_priv(dev);

	    (struct ks_wlan_private *)netdev_priv(dev);

	struct iw_scan_req *req = NULL;

	struct iw_scan_req *req = NULL;

	int len;

	DPRINTK(2, "\n");

	DPRINTK(2, "\n");





	if (priv->sleep_mode == SLP_SLEEP) {

	if (priv->sleep_mode == SLP_SLEEP) {
@@ -1415,8 +1416,9 @@ static int ks_wlan_set_scan(struct net_device *dev, 
	if (wrqu->data.length == sizeof(struct iw_scan_req)

	if (wrqu->data.length == sizeof(struct iw_scan_req)

	    && wrqu->data.flags & IW_SCAN_THIS_ESSID) {

	    && wrqu->data.flags & IW_SCAN_THIS_ESSID) {

		req = (struct iw_scan_req *)extra;

		req = (struct iw_scan_req *)extra;

		priv->scan_ssid_len = req->essid_len;

		len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);

		memcpy(priv->scan_ssid, req->essid, priv->scan_ssid_len);

		priv->scan_ssid_len = len;

		memcpy(priv->scan_ssid, req->essid, len);

	} else {

	} else {

		priv->scan_ssid_len = 0;

		priv->scan_ssid_len = 0;

	}

	}