Received: by 2002:a05:6358:3188:b0:123:57c1:9b43 with SMTP id q8csp34936447rwd; Sun, 9 Jul 2023 23:36:47 -0700 (PDT) X-Google-Smtp-Source: APBJJlH3DIirBcTlQTOyVQMUxdSU27fSA9vxX6oVJMLU9fzhwVXmrb1r2IVcf/iUz9CBdQztF1so X-Received: by 2002:ae9:d614:0:b0:767:2bbc:fcc7 with SMTP id r20-20020ae9d614000000b007672bbcfcc7mr10549858qkk.14.1688971007256; Sun, 09 Jul 2023 23:36:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688971007; cv=none; d=google.com; s=arc-20160816; b=BRQpgRiqETiIhs8oOy3l3X+WUQQszZrhh5Nw7Ay6c8RttluvA91CV8vWWMhy3RMO1d kAInf/6mJuOJWzwXanoey+/j8ehMblGLGxW+mSuUBbeKm7jhlBJVGiwKq/b7DSrYL0U7 gDfbg0mIAg/oyPRmdlkSMT9RdhXSFDaJT0Mvv4uJXX20Umm07+TzG/3vNy9AV4oycO4c HztL2WDfAvQbHDH2swulc7CXDy0HRyVzlM80GaFZf4PGYQKPbSB7A+eOyIHE1w78qXLZ 23uKFMlyXHHiaHy8DCnAIQQtPCS3WYtgOj+BeKmQvNrm9WlmtPhb8MLkexKuxNkve3X7 5GxA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date:dkim-signature; bh=4SVhLr95VKg7glfqsuHxNHjzeVCLSq/G/5K7c2rnENU=; fh=MmbG3v3UgH2wCLLc5g+cMVx2HvAyK3Wcm1nEsfgOyjg=; b=bwhrNfCM7frFyfQ2X3OGgQSQKGVMV/ThBpq64GbLrukG5BiTaU51i4fZ9hpdpEJ+2j 3vH45tO2wegjCCJACxIam68FFRUcx7NOf2M2lKUVp9BJPQlUSJQS/G2OZvwiv1/NlAmp RGgwySqk1lG5v5cu2uiXljtFdbmr1vet1d/hif4YOGfU9PBAtitWEYkGDzWG4ljgt5TK PAZ08jPFFdQYhMLXmCoZE0WUm3ikaFGANmko16V8e3yoyGFTxuIK+pPTFtjSKDP1skJp KV4JoX3uwA7cDGT6NH+iMWbuR6k09W72fylJHjJorZvhnpIB4Sj1Zay+zMj23Oyt/pvC tnXQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=v25DDkqI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id u16-20020a17090341d000b001b9be4a5fbcsi7157390ple.306.2023.07.09.23.36.35; Sun, 09 Jul 2023 23:36:47 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=v25DDkqI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230228AbjGJGIg (ORCPT + 99 others); Mon, 10 Jul 2023 02:08:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57318 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229496AbjGJGIf (ORCPT ); Mon, 10 Jul 2023 02:08:35 -0400 Received: from mail-wm1-x32f.google.com (mail-wm1-x32f.google.com [IPv6:2a00:1450:4864:20::32f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 51E7CFA for ; Sun, 9 Jul 2023 23:08:34 -0700 (PDT) Received: by mail-wm1-x32f.google.com with SMTP id 5b1f17b1804b1-3fbc63c2e84so45625805e9.3 for ; Sun, 09 Jul 2023 23:08:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1688969313; x=1691561313; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=4SVhLr95VKg7glfqsuHxNHjzeVCLSq/G/5K7c2rnENU=; b=v25DDkqIvucSEnkVDBb88JM62u6UhxMQmhQEFtBnnepd5N01xMl0aZZVn6408Mc+Lw EFk7fZY6ZcEQk23n4bad7oobs3z43ET/5TOUpQYiKV3TExv0Sl2RvoRjLmyDn3uJAEMR iJ1Y8GLCpUMkEmnzpAzlxQfEL4/5GRMZ61m03oOd0P9sIYjwxLnfmhV3kgMagrlCMVxe BWmdvCcBx5yeF2EjT5bhkQcLc+t2EMDaULwR9sUI5uajclE+BbbyNM5ASzl/OW8UA0fY LlYmv7/OZg1goHL8cROLX+UMOCCmx3Rt7Iq2Vi5Vqjh+nM6oel3ayJ1lV8cVlz/oHDjy E+0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1688969313; x=1691561313; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=4SVhLr95VKg7glfqsuHxNHjzeVCLSq/G/5K7c2rnENU=; b=fKVtkhwU4AwzAkKld46HWrOGSBNjtp79MY8O9U9EzzYI4fTSqiDklzYC/BU2EZr/lj z1JPpSRbWjtJf8viVdX/9qtnEMnvjGbfAkMA8PmBLMw1SI89VC8swcg1QrVq8soBApUC GqmkK2CNU8uj/0Vn5KLx1tvcJaKitUYil7oj6vrN+xr15bh6I9+9sph+taaTorIP0pLm fzXfCBFCDH7EN2Lw951WgpnxFCR3JsKoa16WxW3B46TIs+W4wusIdp5JNlUPAqVnCcQ/ U5cVmWHstuz+PIHzgmt8mBX0najMYbQX16O6U0otFK9Dex3b8ZLlwFAPnNyp4BGOUqs1 mdJw== X-Gm-Message-State: ABy/qLYRK/AeoabwZj/HCGLI1nUQvKiQ3LMprkpBUeXo0xEw+owFxSzI 2uIgg8UtPVRy+YRSsoOX8LQcuhzzLZdYQppehLM= X-Received: by 2002:a1c:4b0a:0:b0:3fb:d1db:545b with SMTP id y10-20020a1c4b0a000000b003fbd1db545bmr10833003wma.20.1688969312699; Sun, 09 Jul 2023 23:08:32 -0700 (PDT) Received: from localhost ([102.36.222.112]) by smtp.gmail.com with ESMTPSA id z19-20020a1c4c13000000b003fbcdba1a63sm9235567wmf.12.2023.07.09.23.08.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jul 2023 23:08:30 -0700 (PDT) Date: Mon, 10 Jul 2023 09:08:27 +0300 From: Dan Carpenter To: Zhang Shurong Cc: gregkh@linuxfoundation.org, error27@gmail.com, xu.panda@zte.com.cn, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org Subject: Re: [PATCH] staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Jul 09, 2023 at 01:50:07PM +0800, Zhang Shurong wrote: > The "exc->key_len" is a u16 that comes from the user. If it's over > IW_ENCODING_TOKEN_MAX (64) that could lead to memory corruption. > > Fixes: b121d84882b9 ("staging: ks7010: simplify calls to memcpy()") > > Signed-off-by: Zhang Shurong Reviewed-by: Dan Carpenter regards, dan carpenter