lkml.org 
[lkml]   [2021]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 120/126] staging: rtl8192e: Fix incorrect source in memcpy()
    Date
    From: Atul Gopinathan <atulgopinathan@gmail.com>

    commit 72ad25fbbb78930f892b191637359ab5b94b3190 upstream.

    The variable "info_element" is of the following type:

    struct rtllib_info_element *info_element

    defined in drivers/staging/rtl8192e/rtllib.h:

    struct rtllib_info_element {
    u8 id;
    u8 len;
    u8 data[];
    } __packed;

    The "len" field defines the size of the "data[]" array. The code is
    supposed to check if "info_element->len" is greater than 4 and later
    equal to 6. If this is satisfied then, the last two bytes (the 4th and
    5th element of u8 "data[]" array) are copied into "network->CcxRmState".

    Right now the code uses "memcpy()" with the source as "&info_element[4]"
    which would copy in wrong and unintended information. The struct
    "rtllib_info_element" has a size of 2 bytes for "id" and "len",
    therefore indexing will be done in interval of 2 bytes. So,
    "info_element[4]" would point to data which is beyond the memory
    allocated for this pointer (that is, at x+8, while "info_element" has
    been allocated only from x to x+7 (2 + 6 => 8 bytes)).

    This patch rectifies this error by using "&info_element->data[4]" which
    correctly copies the last two bytes of "data[]".

    NOTE: The faulty line of code came from the following commit:

    commit ecdfa44610fa ("Staging: add Realtek 8192 PCI wireless driver")

    The above commit created the file `rtl8192e/ieee80211/ieee80211_rx.c`
    which had the faulty line of code. This file has been deleted (or
    possibly renamed) with the contents copied in to a new file
    `rtl8192e/rtllib_rx.c` along with additional code in the commit
    94a799425eee (tagged in Fixes).

    Fixes: 94a799425eee ("From: wlanfae <wlanfae@realtek.com> [PATCH 1/8] rtl8192e: Import new version of driver from realtek")
    Cc: stable@vger.kernel.org
    Signed-off-by: Atul Gopinathan <atulgopinathan@gmail.com>
    Link: https://lore.kernel.org/r/20210323113413.29179-1-atulgopinathan@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/staging/rtl8192e/rtllib_rx.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/staging/rtl8192e/rtllib_rx.c
    +++ b/drivers/staging/rtl8192e/rtllib_rx.c
    @@ -1968,7 +1968,7 @@ static void rtllib_parse_mife_generic(st
    info_element->data[2] == 0x96 &&
    info_element->data[3] == 0x01) {
    if (info_element->len == 6) {
    - memcpy(network->CcxRmState, &info_element[4], 2);
    + memcpy(network->CcxRmState, &info_element->data[4], 2);
    if (network->CcxRmState[0] != 0)
    network->bCcxRmEnable = true;
    else

    \
     
     \ /
      Last update: 2021-04-05 11:41    [W:4.563 / U:0.304 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site