Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Sender: kvalo=codeaurora.org@mg.codeaurora.org
DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 5678EC433D3
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [v2] ipw2x00: potential buffer overflow in
 libipw_wx_set_encodeext()
From:   Kalle Valo <kvalo@codeaurora.org>
In-Reply-To: <YHaoA1i+8uT4ir4h@mwanda>
References: <YHaoA1i+8uT4ir4h@mwanda>
To:     Dan Carpenter <dan.carpenter@oracle.com>
Cc:     Stanislav Yakovlev <stas.yakovlev@gmail.com>,
        James Ketrenos <jketreno@linux.intel.com>,
        Jeff Garzik <jgarzik@pobox.com>,
        linux-wireless@vger.kernel.org, kernel-janitors@vger.kernel.org
User-Agent: pwcli/0.1.0-git (https://github.com/kvalo/pwcli/) Python/3.5.2
Message-Id: <20210417173607.166C8C433F1@smtp.codeaurora.org>
Date:   Sat, 17 Apr 2021 17:36:07 +0000 (UTC)
Precedence: bulk

Dan Carpenter <dan.carpenter@oracle.com> wrote:

> The "ext->key_len" is a u16 that comes from the user.  If it's over
> SCM_KEY_LEN (32) that could lead to memory corruption.
> 
> Fixes: e0d369d1d969 ("[PATCH] ieee82011: Added WE-18 support to default wireless extension handler")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Acked-by: Stanislav Yakovlev <stas.yakovlev@gmail.com>

Patch applied to wireless-drivers-next.git, thanks.

260a9ad94467 ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/YHaoA1i+8uT4ir4h@mwanda/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches