Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 91fca6da authored by Dan Aloni's avatar Dan Aloni Committed by Greg Kroah-Hartman
Browse files

Staging: prevent rtl8192su from crashing dev_ioctl in SIOCGIWNAME 



(adapted from the rtl8187se patch)

ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.

    length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17

This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.

It can be applied to 2.6.30-stable as well.

Signed-off-by: default avatarDan Aloni <dan@aloni.org>
Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 02c8baec

drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c

+7 −7
Original line number Original line Diff line number Diff line
@@ -548,21 +548,21 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee, 
			     struct iw_request_info *info,

			     struct iw_request_info *info,

			     union iwreq_data *wrqu, char *extra)

			     union iwreq_data *wrqu, char *extra)

{

{

	strcpy(wrqu->name, "802.11");

	strlcpy(wrqu->name, "802.11", IFNAMSIZ);

	if(ieee->modulation & IEEE80211_CCK_MODULATION){

	if(ieee->modulation & IEEE80211_CCK_MODULATION){

		strcat(wrqu->name, "b");

		strlcat(wrqu->name, "b", IFNAMSIZ);

		if(ieee->modulation & IEEE80211_OFDM_MODULATION)

		if(ieee->modulation & IEEE80211_OFDM_MODULATION)

			strcat(wrqu->name, "/g");

			strlcat(wrqu->name, "/g", IFNAMSIZ);

	}else if(ieee->modulation & IEEE80211_OFDM_MODULATION)

	}else if(ieee->modulation & IEEE80211_OFDM_MODULATION)

		strcat(wrqu->name, "g");

		strlcat(wrqu->name, "g", IFNAMSIZ);

	if (ieee->mode & (IEEE_N_24G | IEEE_N_5G))

	if (ieee->mode & (IEEE_N_24G | IEEE_N_5G))

		strcat(wrqu->name, "/n");

		strlcat(wrqu->name, "/n", IFNAMSIZ);





	if((ieee->state == IEEE80211_LINKED) ||

	if((ieee->state == IEEE80211_LINKED) ||

		(ieee->state == IEEE80211_LINKED_SCANNING))

		(ieee->state == IEEE80211_LINKED_SCANNING))

		strcat(wrqu->name," linked");

		strlcat(wrqu->name, "  link", IFNAMSIZ);

	else if(ieee->state != IEEE80211_NOLINK)

	else if(ieee->state != IEEE80211_NOLINK)

		strcat(wrqu->name," link..");

		strlcat(wrqu->name, " .....", IFNAMSIZ);









	return 0;

	return 0;