Received: by 2002:a05:6a10:8c0a:0:0:0:0 with SMTP id go10csp1284635pxb; Fri, 26 Feb 2021 07:10:42 -0800 (PST) X-Google-Smtp-Source: ABdhPJya3S0M2APGIgqxv9kGB08OBmNg5I0Epyr3Cs+06eN4eh8JAjhFq3BNKCnjisz/lwZt/Wof X-Received: by 2002:aa7:dace:: with SMTP id x14mr3869329eds.142.1614352242568; Fri, 26 Feb 2021 07:10:42 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1614352242; cv=none; d=google.com; s=arc-20160816; b=QsEqfSxOyKG9POfujVenECHgcgRT1IzZx3WeiFP5hO+4Aud1hjU7cKdaeCM112YJIO Om/elsArOgq6bVccWgI+bzfZ7v2wHOATWgjd/ZtUhRJoTlPphnd4teM56Mii13jAspvB P5fdq0Z8i8BZV3jyepRMyfOipbCKFmk8fbm3lY7wHjWLAZu3kNpmmF1G9IFGsc2vt+dT tFeWBq9aSaluEk1u7eDIkC3hx0UDEb5sKrgfoCgnOo5NV650v3teeOAo91k8SM1yAIdI I34hksXgxuXQLJtwtFSAwZM7Hcp1stZmBZbrHHZ9LIqAXIbbkuMWdKOvcs8onsajjlMB 3enQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:user-agent:in-reply-to:content-disposition :mime-version:references:message-id:subject:cc:to:from:date :dkim-signature; bh=lYKik5BaWunWMsX+x24nbiXnyXkm1hcCggYQ3wbiOsE=; b=p4NoSGMbvrPMEwyZ/1MMQyz9IeV1XZcCSrFoCBSX8xdUHMizK+HES8X8HuvRnVkcZo QoYTi+2ATiVY3zLz36IlIe5A/69hh/Tayoi2bXJ5sZsE3XfV3hlq4jwJ3HqACkVJ/XS7 IaIeVb2yu0JR3fRWWFPmxHa3MmhUOWilz+4wmJ02+kyiQXKrjItz/i5BsI09IfbzzXyJ q9u907bDPe7hXluNeWg5xqE30EcXpsw97U40TGHJEcqpz5xPudKpdXQrMYgCT0T3kWMf 42qZi/kOa0TKiGvgCYJCz0+9/wACD2qZX+MD1RrDx9fjFX5X4m69iI7x4kfWWlYD+3pI wXvA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2020-01-29 header.b=yXPsmDgZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id q2si3773930edw.238.2021.02.26.07.10.10; Fri, 26 Feb 2021 07:10:42 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2020-01-29 header.b=yXPsmDgZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229586AbhBZPHG (ORCPT + 99 others); Fri, 26 Feb 2021 10:07:06 -0500 Received: from userp2120.oracle.com ([156.151.31.85]:36216 "EHLO userp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229535AbhBZPHG (ORCPT ); Fri, 26 Feb 2021 10:07:06 -0500 Received: from pps.filterd (userp2120.oracle.com [127.0.0.1]) by userp2120.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 11QF4j8B113000; Fri, 26 Feb 2021 15:06:21 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : in-reply-to; s=corp-2020-01-29; bh=lYKik5BaWunWMsX+x24nbiXnyXkm1hcCggYQ3wbiOsE=; b=yXPsmDgZlrF2FZ8WVL9u6zq2IshP7m5HvIr6hkfsLsckdfe9MVUZGp9P8585bwYnm9dh nTWKFKY/MaGeeSi+k6R6BzOcVuFpugTPWctNh5cBFcBFyFbCGFf0hye0a9uwpsbNvc7Y mtqTBHlxmFzMGCa1kaJfGLtRXwD8NOaqpdIZ42gBCXG+6yXTNVs5/RZOtxxaQ67dDjRH megUfeIcjadbFboIvtBVPUFkM6BgLCWddru14Y4eCb2PZbDAr1ksCOfwCcxIDUTo9q5L LLb2Y082eBO+vQjlIi6rOBVONkVFbrUu5rY0RJPfd77JyzRPaPRXxwAm9hLnIcDU+oYN IQ== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by userp2120.oracle.com with ESMTP id 36ugq3s3xc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 26 Feb 2021 15:06:21 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 11QF6ITW071618; Fri, 26 Feb 2021 15:06:19 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userp3020.oracle.com with ESMTP id 36uc6w06ff-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 26 Feb 2021 15:06:19 +0000 Received: from abhmp0017.oracle.com (abhmp0017.oracle.com [141.146.116.23]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id 11QF6E2H018298; Fri, 26 Feb 2021 15:06:15 GMT Received: from kadam (/102.36.221.92) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 26 Feb 2021 07:06:14 -0800 Date: Fri, 26 Feb 2021 18:06:07 +0300 From: Dan Carpenter To: Lee Gibson Cc: gregkh@linuxfoundation.org, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v3] staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan Message-ID: <20210226150607.GI2222@kadam> References: <20210226145157.424065-1-leegib@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210226145157.424065-1-leegib@gmail.com> User-Agent: Mutt/1.9.4 (2018-02-28) X-Proofpoint-IMR: 1 X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9907 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 spamscore=0 mlxlogscore=999 adultscore=0 bulkscore=0 malwarescore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2102260117 X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9907 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 phishscore=0 malwarescore=0 spamscore=0 mlxscore=0 suspectscore=0 priorityscore=1501 clxscore=1015 impostorscore=0 lowpriorityscore=0 mlxlogscore=999 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2102260117 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Feb 26, 2021 at 02:51:57PM +0000, Lee Gibson wrote: > Function _rtl92e_wx_set_scan calls memcpy without checking the length. > A user could control that length and trigger a buffer overflow. > Fix by checking the length is within the maximum allowed size. > > Reviewed-by: Dan Carpenter > Signed-off-by: Lee Gibson > --- Thanks! regards, dan carpenter