Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fcd2042e authored by Brian Norris's avatar Brian Norris Committed by Kalle Valo
Browse files

mwifiex: printk() overflow with 32-byte SSIDs 



SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
when we print them out.

This can be easily noticed by connecting to a network with a 32-octet
SSID:

[ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to
'0123456789abcdef0123456789abcdef <uninitialized mem>' bssid
xx:xx:xx:xx:xx:xx

Fixes: 5e6e3a92 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: default avatarBrian Norris <briannorris@chromium.org>
Cc: <stable@vger.kernel.org>
Acked-by: default avatarAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent d3532ea6

drivers/net/wireless/marvell/mwifiex/cfg80211.c

+7 −6
Original line number Diff line number Diff line
@@ -2222,8 +2222,9 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, 
			is_scanning_required = 1;

		} else {

			mwifiex_dbg(priv->adapter, MSG,

				    "info: trying to associate to '%s' bssid %pM\n",

				    (char *)req_ssid.ssid, bss->bssid);

				    "info: trying to associate to '%.*s' bssid %pM\n",

				    req_ssid.ssid_len, (char *)req_ssid.ssid,

				    bss->bssid);

			memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN);

			break;

		}
@@ -2283,8 +2284,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev, 
	}



	mwifiex_dbg(adapter, INFO,

		    "info: Trying to associate to %s and bssid %pM\n",

		    (char *)sme->ssid, sme->bssid);

		    "info: Trying to associate to %.*s and bssid %pM\n",

		    (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);



	if (!mwifiex_stop_bg_scan(priv))

		cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
@@ -2417,8 +2418,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev, 
	}



	mwifiex_dbg(priv->adapter, MSG,

		    "info: trying to join to %s and bssid %pM\n",

		    (char *)params->ssid, params->bssid);

		    "info: trying to join to %.*s and bssid %pM\n",

		    params->ssid_len, (char *)params->ssid, params->bssid);



	mwifiex_set_ibss_params(priv, params);