Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp3522744pxf; Mon, 15 Mar 2021 11:26:33 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz3COEqt+OdeqTSB9ffVNBwvhTw/XbXG3TTL2erYrQptpDnsZNtqiqxKTaIYq3Y5KpZyE2S X-Received: by 2002:a17:906:a106:: with SMTP id t6mr25482632ejy.63.1615832793718; Mon, 15 Mar 2021 11:26:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615832793; cv=none; d=google.com; s=arc-20160816; b=l6g5tF26d74pIx2KM3vfVaSJX5oa2dszmbZe9UgUGOLTdhC5MR9/SXXQ8hxYaCiISf lgdFCHjZmjvpBOlx2gYyjw8rrZLZt82Pin3a/mtaqw3dyQ+p+mNCv2RoDtIU2B1TMpKy N/Qr7zE417keiFjQe8NKM367XkqM7G1GSu00/U6PqoKO9yAWpg09+Bo/WQRBgchkUNpw cE9vJI2S4yTRw7XxjNjGNurp3zkRrFITxuayymbVSebZER5Xi5EkSPRdW6NBVog0Cr5V 933N96oex+O4qkKWnD+p/qobs3dySdKrhXHtXatccAGDin3mbiIaNokWTXxFZjBphmOb hadA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=DsHpXTafzELlo3sdzmHULooGhEWVkJvmN9c8m7lbcWY=; b=dvqx9lWcsDO1R335o8EdgPnCpCk5Ki39G31gFfEzH4LkLlwX8/nNxEazAC+ty2m5gn 1RPO5hp7WMZUsVKyQrGJCox4L5uONV+Wxj+fz8UmqHu/QsgTM5PLl5xWYU/sK++/zGNo uReGJvPR7/G0gyH3mAu/XWM2tW2YU22yl3IuT1sr0Jh6FoO6zH11yTDuwfjh5xAgWp73 whxZ3p0IkcSmosj4UULzw6S7O3pZ4snwpW61IoQ+CQ7Ac+JaupFjurgGnUSwbc4Mhsll 9dMIwTWdQQc6AaBecIuVUq1Klllv2yi0uE6eHqQkjtu3zuJllB/2FgxaRxlmr25tdr/9 spRA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="tel/cYOz"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id a20si12114356eda.157.2021.03.15.11.25.51; Mon, 15 Mar 2021 11:26:33 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="tel/cYOz"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238937AbhCOO1S (ORCPT + 99 others); Mon, 15 Mar 2021 10:27:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:37612 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233089AbhCOOAh (ORCPT ); Mon, 15 Mar 2021 10:00:37 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 2CF6B64F05; Mon, 15 Mar 2021 14:00:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816824; bh=IJILXJ/lhva1CVUuh0ztC/78LgrZs7xs5AEiyjmg0do=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tel/cYOzvAghJCTpOwSl+psjYxKtMG0uKmzE80Ir65h4gNfYq5sVD9crG2UjT2tO8 Z2ssgODv0MsNTkem9lG5AbONPwpsyXEU3ywrb54oaJgzBGI112JAHCV587g8/2em9B VL/tnZ/EwPWjK412izn3wm/TCWmGa4FszbI9PLPU= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter Subject: [PATCH 4.19 092/120] staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data() Date: Mon, 15 Mar 2021 14:57:23 +0100 Message-Id: <20210315135722.989691938@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135720.002213995@linuxfoundation.org> References: <20210315135720.002213995@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman From: Dan Carpenter commit d4ac640322b06095128a5c45ba4a1e80929fe7f3 upstream. The "ie_len" is a value in the 1-255 range that comes from the user. We have to cap it to ensure that it's not too large or it could lead to memory corruption. Fixes: 9a7fe54ddc3a ("staging: r8188eu: Add source files for new driver - part 1") Signed-off-by: Dan Carpenter Cc: stable Link: https://lore.kernel.org/r/YEHyQCrFZKTXyT7J@mwanda Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8188eu/core/rtw_ap.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/staging/rtl8188eu/core/rtw_ap.c +++ b/drivers/staging/rtl8188eu/core/rtw_ap.c @@ -794,6 +794,7 @@ int rtw_check_beacon_data(struct adapter /* SSID */ p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SSID_IE_, &ie_len, (pbss_network->ie_length - _BEACON_IE_OFFSET_)); if (p && ie_len > 0) { + ie_len = min_t(int, ie_len, sizeof(pbss_network->Ssid.Ssid)); memset(&pbss_network->Ssid, 0, sizeof(struct ndis_802_11_ssid)); memcpy(pbss_network->Ssid.Ssid, (p + 2), ie_len); pbss_network->Ssid.SsidLength = ie_len; @@ -812,6 +813,7 @@ int rtw_check_beacon_data(struct adapter /* get supported rates */ p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SUPPORTEDRATES_IE_, &ie_len, (pbss_network->ie_length - _BEACON_IE_OFFSET_)); if (p) { + ie_len = min_t(int, ie_len, NDIS_802_11_LENGTH_RATES_EX); memcpy(supportRate, p + 2, ie_len); supportRateNum = ie_len; } @@ -819,6 +821,8 @@ int rtw_check_beacon_data(struct adapter /* get ext_supported rates */ p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _EXT_SUPPORTEDRATES_IE_, &ie_len, pbss_network->ie_length - _BEACON_IE_OFFSET_); if (p) { + ie_len = min_t(int, ie_len, + NDIS_802_11_LENGTH_RATES_EX - supportRateNum); memcpy(supportRate + supportRateNum, p + 2, ie_len); supportRateNum += ie_len; } @@ -932,6 +936,7 @@ int rtw_check_beacon_data(struct adapter pht_cap->mcs.rx_mask[0] = 0xff; pht_cap->mcs.rx_mask[1] = 0x0; + ie_len = min_t(int, ie_len, sizeof(pmlmepriv->htpriv.ht_cap)); memcpy(&pmlmepriv->htpriv.ht_cap, p+2, ie_len); }