Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
From:   Denis Efremov <denis.e.efremov@oracle.com>
To:     Larry.Finger@lwfinger.net
Cc:     Denis Efremov <denis.e.efremov@oracle.com>, phil@philpotter.co.uk,
        gregkh@linuxfoundation.org, dan.carpenter@oracle.com,
        straube.linux@gmail.com, linux-staging@lists.linux.dev,
        linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org,
        stable <stable@vger.kernel.org>
Subject: [PATCH] staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()
Date:   Wed, 18 May 2022 11:00:52 +0400
Message-Id: <20220518070052.108287-1-denis.e.efremov@oracle.com>
In-Reply-To: <YEHymwsnHewzoam7@mwanda>
References: <YEHymwsnHewzoam7@mwanda>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?ssXNxNNRazykBgYWJtcvXgPAT3DfL6LKJgUx0vRFpH3LXZmJUbyC30h7ArRL?=
 =?us-ascii?Q?cUlQ+UgL1tTsPszc4rDXWBtd/qB9Db8jWfqQ1JW+cvRYeSDcJVxh4yK617sT?=
 =?us-ascii?Q?88oWDdVrqfS/yrId+Ev90RkDUHIgAqVnlvhACeULgW/lbsqT4toRoUtu4G2W?=
 =?us-ascii?Q?TBEx339bJVmYkfgUCFSFDy3oYUmQvhHMCmmXkKGY4LUJJheDpFJlKQXlbu6W?=
 =?us-ascii?Q?HdCPLLK7/eXRc9ZxEeSBk9yANecUvjvthzEjxcnWNZD1a2S0OETGpgU9HGKT?=
 =?us-ascii?Q?+lmS/p3vU/lwmDQf7GpDE7JWU1uxEgcyRclHAffew6C2wEI9GQdNsApM3uwx?=
 =?us-ascii?Q?VLqi9xS5exjGrii7r4G0emuJn9OlbOI9ZHwHEkBWBF0kKIY95RT76QOiZj7R?=
 =?us-ascii?Q?gpxsjXwaCWClSmCHrH2a4oHANOnVi2SsMG231WXaygGDxW/KNgsEcFMPY7Ja?=
 =?us-ascii?Q?ulg8FLp0dxgeii+Wza0cueEJ8Gjf+0/rCt3D2epqGJ9F9HRr+njy8B6+FExA?=
 =?us-ascii?Q?AiYOg4CGLsnFimoEgvL9536ao2AY8NhnBjZ1HaDp8tDKK5vsznk3Wi/DY5eu?=
 =?us-ascii?Q?PMpUBhYBRaiGQPcSEnAv+w2RbiLn16Xv0NXVuYXazrfDfGZnBk1ceoNZCCNb?=
 =?us-ascii?Q?MAgOk8rQeRfYfxmOk83NmzrRnHERGPJJAADEDoXT30V+L9oy46eC7/V0duzy?=
 =?us-ascii?Q?YbUKgqWXArgR5I9x+sQk22U2MTwr0oVl36KcwW6sg1HyNsIM6IglJ3JzJkF4?=
 =?us-ascii?Q?Qb+zsn0w/FWBpJYMQ/mYp4WlrT/kXRoSFiFw6uUKA+wBfrb+BiurGp7OT9cu?=
 =?us-ascii?Q?Gq+erpp7YdIUFYOl/p4BUdbXnzMpO+oVdVuOI6gmZIoIv4Xp1lXRzUZtgEWA?=
 =?us-ascii?Q?wvuRAH+Ri57VpLruwY2D0mzSF8Qh+/E1q67lCOAxW6XMaX/H+Z6WLDDaw//2?=
 =?us-ascii?Q?Rqym3UbfXt0ChJdkyZoeZXH8SaWZUstDnj2+DCM9Uk+8EVq9EhxAOC8gH7X2?=
 =?us-ascii?Q?IjBdSs/yzbzme501mW9xq0id36mu5ilxxekf+aGidat2DNomWhbAyJR233N3?=
 =?us-ascii?Q?wVk4uTNs1kHXGLqu1lJ+UwyTPYn7XV2M0vbeBDGKKs/pmX9Tbvu2IwKTuFVt?=
 =?us-ascii?Q?O025VqbvTHZ6llJAEfzojcaEz7WUVa8ZlPvlumfBPXn7grUDct2n6v6lWxzg?=
 =?us-ascii?Q?n6BwA2Vibe2Dyx8hi0P00lsLtrpMozyAGA0VnmF0dp+gvZnr//Uv6fVYNKl1?=
 =?us-ascii?Q?0Zweqqz2rxiLTogeoi5KKEAM8JPu3rC3lXGrPMLxutA0/DsI9TDLATzilGOS?=
 =?us-ascii?Q?vv+eN2JeAd9KxO9lLfk0i810uOf+NFPxSPFjin80VKf/Ai+hCM0r/IlD7hkd?=
 =?us-ascii?Q?pD1Ykc7bScZSFvc82F5Mmq2ZvXGyt7Pzeo8ZwLA9KjZ0JoQrrYHcaIMWkt+v?=
 =?us-ascii?Q?YARcgq2QMXSErD70CEgQHU907fPV19OU3sBHS5F2cTu9Qjc1KxpmRd9EXOKi?=
 =?us-ascii?Q?qZNOS3nH3yC5k1D4Uvlqo2sJuNGVpyuICUPHCx86S5eUADIOdSMOBthfHqqR?=
 =?us-ascii?Q?DB9pdJHg2no9rwSNywi4v9wP8oRjhGGgURdInqJ0LjnIcQsPfA4QivfIbRbP?=
 =?us-ascii?Q?NnnY7wR+IFSxltJPFvLSPMZuyt1eWdMzhpSQHKOUekFe3JW8Na1pB/X8r5eD?=
 =?us-ascii?Q?dWb//PLKXr3qgNwDvzaCjaN8OC3Mj+Mf7o+15zPlyWQz6AjI33OjKe2FY/om?=
 =?us-ascii?Q?yEVi7Whs0Qu3vMZDkc+i+My0iu9tmRI=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e8b46a19-e64f-4b8a-0050-08da389c36d6
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4638.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 May 2022 07:01:22.3332
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 8p/2SuECRIhEWBS9aLXIIIuGTuDY8RmYe4WGWUmEl1Ib0wSERklBolr3Z1xiI9eIk+GaHmaS/i8vTPc+QiQmI/Bmf96zFKh/4ArP22uZHuE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR10MB3393
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.486,18.0.874
 definitions=2022-05-18_02:2022-05-17,2022-05-18 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 mlxscore=0 suspectscore=0
 phishscore=0 bulkscore=0 adultscore=0 mlxlogscore=999 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000
 definitions=main-2205180036
X-Proofpoint-GUID: DGkfysnRvqk2Q0mgVagQI8-ud--WNIgj
X-Proofpoint-ORIG-GUID: DGkfysnRvqk2Q0mgVagQI8-ud--WNIgj
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

This code has a check to prevent read overflow but it needs another
check to prevent writing beyond the end of the ->Ssid[] array.

Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Denis Efremov <denis.e.efremov@oracle.com>
---

This patch is a copy of Dan's 74b6b20df8cf (CVE-2021-28660).
Drivers r8188eu and rtl8188eu share the same code.

 drivers/staging/r8188eu/os_dep/ioctl_linux.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
index eb9375b0c660..a2692ce02bc2 100644
--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
@@ -1131,9 +1131,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
 						break;
 					}
 					sec_len = *(pos++); len -= 1;
-					if (sec_len > 0 && sec_len <= len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].SsidLength = sec_len;
-						memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						memcpy(ssid[ssid_index].Ssid, pos, sec_len);
 						ssid_index++;
 					}
 					pos += sec_len;
-- 
2.35.3