lkml.org 
[lkml]   [2009]   [Jul]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 09/71] Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME
    2.6.30-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Dan Aloni <dan@aloni.org>

    commit 02c8baecf5d8850dba40b47cdf003ed2e04e66dd upstream.

    I repeatedly get __stack_chk_fail panic()s with this driver before
    applying the attached fix.

    ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
    on certain conditions, the concatenated string will be larger than IFNAMSIZ
    including the terminating zero.

    length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17

    This fix uses strl{cpy,cat} in addition to the reduction of the total
    possible length of the output string by a char.

    It can be applied to 2.6.30-stable as well.

    Signed-off-by: Dan Aloni <dan@aloni.org>
    Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c | 12 ++++++------
    1 file changed, 6 insertions(+), 6 deletions(-)

    --- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
    +++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
    @@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee802
    struct iw_request_info *info,
    union iwreq_data *wrqu, char *extra)
    {
    - strcpy(wrqu->name, "802.11");
    + strlcpy(wrqu->name, "802.11", IFNAMSIZ);
    if(ieee->modulation & IEEE80211_CCK_MODULATION){
    - strcat(wrqu->name, "b");
    + strlcat(wrqu->name, "b", IFNAMSIZ);
    if(ieee->modulation & IEEE80211_OFDM_MODULATION)
    - strcat(wrqu->name, "/g");
    + strlcat(wrqu->name, "/g", IFNAMSIZ);
    }else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
    - strcat(wrqu->name, "g");
    + strlcat(wrqu->name, "g", IFNAMSIZ);

    if((ieee->state == IEEE80211_LINKED) ||
    (ieee->state == IEEE80211_LINKED_SCANNING))
    - strcat(wrqu->name," linked");
    + strlcat(wrqu->name," link", IFNAMSIZ);
    else if(ieee->state != IEEE80211_NOLINK)
    - strcat(wrqu->name," link..");
    + strlcat(wrqu->name," .....", IFNAMSIZ);


    return 0;



    \
     
     \ /
      Last update: 2009-07-29 01:53    [W:0.020 / U:1.252 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site