LinuxLists.cc - [PATCH] libertas: Fix two buffer overflows at parsing bss descriptor

2019-11-22 05:30:50

Subject: [PATCH] libertas: Fix two buffer overflows at parsing bss descriptor

From: Wen Huang <[email protected]>

add_ie_rates() copys rates without checking the length
in bss descriptor from remote AP.when victim connects to
remote attacker, this may trigger buffer overflow.
lbs_ibss_join_existing() copys rates without checking the length
in bss descriptor from remote IBSS node.when victim connects to
remote attacker, this may trigger buffer overflow.
Fix them by putting the length check before performing copy.

This fix addresses CVE-2019-14896 and CVE-2019-14897.

Signed-off-by: Wen Huang <[email protected]>
---
drivers/net/wireless/marvell/libertas/cfg.c | 8 ++++++++
1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c
index 57edfada0..290280764 100644
--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++ b/drivers/net/wireless/marvell/libertas/cfg.c
@@ -273,6 +273,10 @@ add_ie_rates(u8 *tlv, const u8 *ie, int *nrates)
int hw, ap, ap_max = ie[1];
u8 hw_rate;

+ if (ap_max > MAX_RATES) {
+ lbs_deb_assoc("invalid rates\n");
+ return tlv;
+ }
/* Advance past IE header */
ie += 2;

@@ -1777,6 +1781,10 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
} else {
int hw, i;
u8 rates_max = rates_eid[1];
+ if (rates_max > MAX_RATES) {
+ lbs_deb_join("invalid rates");
+ goto out;
+ }
u8 *rates = cmd.bss.rates;
for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
u8 hw_rate = lbs_rates[hw].bitrate / 5;
--
2.17.1

2019-11-24 07:54:51

by kernel test robot

[permalink] [raw]

Subject: Re: [PATCH] libertas: Fix two buffer overflows at parsing bss descriptor

Hi,

Thank you for the patch! Perhaps something
[auto build test WARNING on wireless-drivers-next/master]
url: reproduce:
wget All warnings (new ones prefixed by >>):
drivers/net/wireless/marvell/libertas/cfg.c: >> drivers/net/wireless/marvell/libertas/cfg.c:1788:3: u8 *rates = cmd.bss.rates;
^~

vim +1788 drivers/net/wireless/marvell/libertas/cfg.c
e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c 9caf03640279e6 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c 683b6d3b31a519 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c 9caf03640279e6 drivers/net/wireless/libertas/cfg.c 9caf03640279e6 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c bb7da3c8c1a225 drivers/net/wireless/marvell/libertas/cfg.c bb7da3c8c1a225 drivers/net/wireless/marvell/libertas/cfg.c bb7da3c8c1a225 drivers/net/wireless/marvell/libertas/cfg.c bb7da3c8c1a225 drivers/net/wireless/marvell/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c 9caf03640279e6 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c
:::::: The code at line 1788 was first introduced :::::: e86dc1ca4676445d9f0dfe35104efe0eb8a2f566
:::::: TO: Kiran Divekar ---
0-DAY kernel test infrastructure https://stackoverflow.com/a/37406982]
/commits/huangwenabc-gmail-com/libertas-Fix-two-buffer-overflows-at-parsing-bss-descriptor/20191124-142236">https://github.com/0day-ci/linux/commits/huangwenabc-gmail-com/libertas-Fix-two-buffer-overflows-at-parsing-bss-descriptor/20191124-142236
inux/kernel/git/kvalo/wireless-drivers-next.git">https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git master
/> nt.com/intel/lkp-tests/master/sbin/make.cross">https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
build tree

tag
/email-protection#ecca8098d780879cac8582988980c28f8381ca8b98d7"><[email protected]>
/> In function 'lbs_ibss_join_existing':
warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
/> Kiran Divekar 2010-06-14 1715
Kiran Divekar 2010-06-14 1716 static int lbs_ibss_join_existing(struct lbs_private *priv,
Kiran Divekar 2010-06-14 1717 struct cfg80211_ibss_params *params,
Kiran Divekar 2010-06-14 1718 struct cfg80211_bss *bss)
Kiran Divekar 2010-06-14 1719 {
Johannes Berg 2012-11-29 1720 const u8 *rates_eid;
Kiran Divekar 2010-06-14 1721 struct cmd_ds_802_11_ad_hoc_join cmd;
Kiran Divekar 2010-06-14 1722 u8 preamble = RADIO_PREAMBLE_SHORT;
Kiran Divekar 2010-06-14 1723 int ret = 0;
Kiran Divekar 2010-06-14 1724
Kiran Divekar 2010-06-14 1725 /* TODO: set preamble based on scan result */
Kiran Divekar 2010-06-14 1726 ret = lbs_set_radio(priv, preamble, 1);
Kiran Divekar 2010-06-14 1727 if (ret)
Kiran Divekar 2010-06-14 1728 goto out;
Kiran Divekar 2010-06-14 1729
Kiran Divekar 2010-06-14 1730 /*
Kiran Divekar 2010-06-14 1731 * Example CMD_802_11_AD_HOC_JOIN command:
Kiran Divekar 2010-06-14 1732 *
Kiran Divekar 2010-06-14 1733 * command 2c 00 CMD_802_11_AD_HOC_JOIN
Kiran Divekar 2010-06-14 1734 * size 65 00
Kiran Divekar 2010-06-14 1735 * sequence xx xx
Kiran Divekar 2010-06-14 1736 * result 00 00
Kiran Divekar 2010-06-14 1737 * bssid 02 27 27 97 2f 96
Kiran Divekar 2010-06-14 1738 * ssid 49 42 53 53 00 00 00 00
Kiran Divekar 2010-06-14 1739 * 00 00 00 00 00 00 00 00
Kiran Divekar 2010-06-14 1740 * 00 00 00 00 00 00 00 00
Kiran Divekar 2010-06-14 1741 * 00 00 00 00 00 00 00 00
Kiran Divekar 2010-06-14 1742 * type 02 CMD_BSS_TYPE_IBSS
Kiran Divekar 2010-06-14 1743 * beacon period 64 00
Kiran Divekar 2010-06-14 1744 * dtim period 00
Kiran Divekar 2010-06-14 1745 * timestamp 00 00 00 00 00 00 00 00
Kiran Divekar 2010-06-14 1746 * localtime 00 00 00 00 00 00 00 00
Kiran Divekar 2010-06-14 1747 * IE DS 03
Kiran Divekar 2010-06-14 1748 * IE DS len 01
Kiran Divekar 2010-06-14 1749 * IE DS channel 01
Kiran Divekar 2010-06-14 1750 * reserveed 00 00 00 00
Kiran Divekar 2010-06-14 1751 * IE IBSS 06
Kiran Divekar 2010-06-14 1752 * IE IBSS len 02
Kiran Divekar 2010-06-14 1753 * IE IBSS atim 00 00
Kiran Divekar 2010-06-14 1754 * reserved 00 00 00 00
Kiran Divekar 2010-06-14 1755 * capability 02 00
Kiran Divekar 2010-06-14 1756 * rates 82 84 8b 96 0c 12 18 24 30 48 60 6c 00
Kiran Divekar 2010-06-14 1757 * fail timeout ff 00
Kiran Divekar 2010-06-14 1758 * probe delay 00 00
Kiran Divekar 2010-06-14 1759 */
Kiran Divekar 2010-06-14 1760 memset(&cmd, 0, sizeof(cmd));
Kiran Divekar 2010-06-14 1761 cmd.hdr.size = cpu_to_le16(sizeof(cmd));
Kiran Divekar 2010-06-14 1762
Kiran Divekar 2010-06-14 1763 memcpy(cmd.bss.bssid, bss->bssid, ETH_ALEN);
Kiran Divekar 2010-06-14 1764 memcpy(cmd.bss.ssid, params->ssid, params->ssid_len);
Kiran Divekar 2010-06-14 1765 cmd.bss.type = CMD_BSS_TYPE_IBSS;
Kiran Divekar 2010-06-14 1766 cmd.bss.beaconperiod = cpu_to_le16(params->beacon_interval);
Kiran Divekar 2010-06-14 1767 cmd.bss.ds.header.id = WLAN_EID_DS_PARAMS;
Kiran Divekar 2010-06-14 1768 cmd.bss.ds.header.len = 1;
Johannes Berg 2012-11-08 1769 cmd.bss.ds.channel = params->chandef.chan->hw_value;
Kiran Divekar 2010-06-14 1770 cmd.bss.ibss.header.id = WLAN_EID_IBSS_PARAMS;
Kiran Divekar 2010-06-14 1771 cmd.bss.ibss.header.len = 2;
Kiran Divekar 2010-06-14 1772 cmd.bss.ibss.atimwindow = 0;
Kiran Divekar 2010-06-14 1773 cmd.bss.capability = cpu_to_le16(bss->capability & CAPINFO_MASK);
Kiran Divekar 2010-06-14 1774
Kiran Divekar 2010-06-14 1775 /* set rates to the intersection of our rates and the rates in the
Kiran Divekar 2010-06-14 1776 bss */
Johannes Berg 2012-11-29 1777 rcu_read_lock();
Johannes Berg 2012-11-29 1778 rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
Kiran Divekar 2010-06-14 1779 if (!rates_eid) {
Kiran Divekar 2010-06-14 1780 lbs_add_rates(cmd.bss.rates);
Kiran Divekar 2010-06-14 1781 } else {
Kiran Divekar 2010-06-14 1782 int hw, i;
Kiran Divekar 2010-06-14 1783 u8 rates_max = rates_eid[1];
Wen Huang 2019-11-22 1784 if (rates_max > MAX_RATES) {
Wen Huang 2019-11-22 1785 lbs_deb_join("invalid rates");
Wen Huang 2019-11-22 1786 goto out;
Wen Huang 2019-11-22 1787 }
Kiran Divekar 2010-06-14 @1788 u8 *rates = cmd.bss.rates;
Kiran Divekar 2010-06-14 1789 for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
Kiran Divekar 2010-06-14 1790 u8 hw_rate = lbs_rates[hw].bitrate / 5;
Kiran Divekar 2010-06-14 1791 for (i = 0; i < rates_max; i++) {
Kiran Divekar 2010-06-14 1792 if (hw_rate == (rates_eid[i+2] & 0x7f)) {
Kiran Divekar 2010-06-14 1793 u8 rate = rates_eid[i+2];
Kiran Divekar 2010-06-14 1794 if (rate == 0x02 || rate == 0x04 ||
Kiran Divekar 2010-06-14 1795 rate == 0x0b || rate == 0x16)
Kiran Divekar 2010-06-14 1796 rate |= 0x80;
Kiran Divekar 2010-06-14 1797 *rates++ = rate;
Kiran Divekar 2010-06-14 1798 }
Kiran Divekar 2010-06-14 1799 }
Kiran Divekar 2010-06-14 1800 }
Kiran Divekar 2010-06-14 1801 }
Johannes Berg 2012-11-29 1802 rcu_read_unlock();
Kiran Divekar 2010-06-14 1803
Kiran Divekar 2010-06-14 1804 /* Only v8 and below support setting this */
Kiran Divekar 2010-06-14 1805 if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {
Kiran Divekar 2010-06-14 1806 cmd.failtimeout = cpu_to_le16(MRVDRV_ASSOCIATION_TIME_OUT);
Kiran Divekar 2010-06-14 1807 cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
Kiran Divekar 2010-06-14 1808 }
Kiran Divekar 2010-06-14 1809 ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_JOIN, &cmd);
Kiran Divekar 2010-06-14 1810 if (ret)
Kiran Divekar 2010-06-14 1811 goto out;
Kiran Divekar 2010-06-14 1812
Kiran Divekar 2010-06-14 1813 /*
Kiran Divekar 2010-06-14 1814 * This is a sample response to CMD_802_11_AD_HOC_JOIN:
Kiran Divekar 2010-06-14 1815 *
Kiran Divekar 2010-06-14 1816 * response 2c 80
Kiran Divekar 2010-06-14 1817 * size 09 00
Kiran Divekar 2010-06-14 1818 * sequence xx xx
Kiran Divekar 2010-06-14 1819 * result 00 00
Kiran Divekar 2010-06-14 1820 * reserved 00
Kiran Divekar 2010-06-14 1821 */
Kiran Divekar 2010-06-14 1822 lbs_join_post(priv, params, bss->bssid, bss->capability);
Kiran Divekar 2010-06-14 1823
Kiran Divekar 2010-06-14 1824 out:
Kiran Divekar 2010-06-14 1825 return ret;
Kiran Divekar 2010-06-14 1826 }
Kiran Divekar 2010-06-14 1827
by commit
Libertas: cfg80211 support
-protection#bc9ad0c887d8d7d5ceddd2fcd1ddcecad9d0d092dfd3d19adbc887"><[email protected]>
ail-protection#e9cf859dd28580879f8085858ca99d9c918d9b809f8c9bc78a8684cf8e9dd2"><[email protected]>
Open Source Technology Center
ild-all@lists.01.org">https://lists.01.org/hyperkitty/list/[email protected] Intel Corporation

Attachments:

(No filename) (15.11 kB)
.config.gz (51.05 kB)
Download all attachments

2019-11-25 12:45:20

by Kalle Valo

[permalink] [raw]

Subject: Re: [PATCH] libertas: Fix two buffer overflows at parsing bss descriptor

kbuild test robot <[email protected]> writes:

> Thank you for the patch! Perhaps something to improve:
>
> [auto build test WARNING on wireless-drivers-next/master]
> [also build test WARNING on v5.4-rc8 next-20191122]
> [if your patch is applied to the wrong git tree, please drop us a note to help
> improve the system. BTW, we also suggest to use '--base' option to specify the
> base tree in git format-patch, please see https://stackoverflow.com/a/37406982]
>
> url: https://github.com/0day-ci/linux/commits/huangwenabc-gmail-com/libertas-Fix-two-buffer-overflows-at-parsing-bss-descriptor/20191124-142236
> base: https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git master
> config: sh-allmodconfig (attached as .config)
> compiler: sh4-linux-gcc (GCC) 7.4.0
> reproduce:
> wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
> chmod +x ~/bin/make.cross
> # save the attached .config to linux build tree
> GCC_VERSION=7.4.0 make.cross ARCH=sh
>
> If you fix the issue, kindly add following tag
> Reported-by: kbuild test robot <[email protected]>
>
> All warnings (new ones prefixed by >>):
>
> drivers/net/wireless/marvell/libertas/cfg.c: In function 'lbs_ibss_join_existing':
>>> drivers/net/wireless/marvell/libertas/cfg.c:1788:3: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]

I was wondering why I didn't see this mail in patchwork:

https://patchwork.kernel.org/patch/11257187/

And then I noticed this:

X-Patchwork-Hint: ignore

kbuild team, why are you adding that header? It's really bad for a
maintainer like me who uses patchwork actively, it means that all these
important warnings are not visible in patchwork and can be easily missed
by the maintainers.

--
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

2019-11-28 08:03:04

by Kalle Valo

[permalink] [raw]

Subject: Re: [PATCH] libertas: Fix two buffer overflows at parsing bss descriptor

[email protected] wrote:

> From: Wen Huang <[email protected]>
>
> add_ie_rates() copys rates without checking the length
> in bss descriptor from remote AP.when victim connects to
> remote attacker, this may trigger buffer overflow.
> lbs_ibss_join_existing() copys rates without checking the length
> in bss descriptor from remote IBSS node.when victim connects to
> remote attacker, this may trigger buffer overflow.
> Fix them by putting the length check before performing copy.
>
> This fix addresses CVE-2019-14896 and CVE-2019-14897.
>
> Signed-off-by: Wen Huang <[email protected]>

Please fix the warning reported by kbuild bot.

Patch set to Changes Requested.

--
https://patchwork.kernel.org/patch/11257187/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

2020-01-09 16:06:19

by Nicolai Stange

[permalink] [raw]

Subject: Re: [PATCH] libertas: Fix two buffer overflows at parsing bss descriptor

Hi,

the patch queued as e5e884b42639 ("libertas: Fix two buffer overflows at
parsing bss descriptor") at the wireless tree doesn't look completely
correct to me.

This hunk here...

diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c
index 57edfada0665..c9401c121a14 100644
--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++ b/drivers/net/wireless/marvell/libertas/cfg.c
@@ -1775,9 +1782,12 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
if (!rates_eid) {
lbs_add_rates(cmd.bss.rates);
} else {
- int hw, i;
- u8 rates_max = rates_eid[1];
- u8 *rates = cmd.bss.rates;
+ rates_max = rates_eid[1];
+ if (rates_max > MAX_RATES) {
+ lbs_deb_join("invalid rates");
+ goto out;

... makes the error path skip over the rcu_read_unlock() following later
in the code and leaves the RCU read section unbalanced.

Also, I'm wondering if ret should perhaps get set to some -Exxxx in case
of rates_max > MAX_RATES?

Thanks,

Nicolai

+ }
+ rates = cmd.bss.rates;
for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
u8 hw_rate = lbs_rates[hw].bitrate / 5;
for (i = 0; i < rates_max; i++) {

--
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg), GF: Felix Imendörffer