Skip to contentSkip to conversation

Patch "mwifiex: printk() overflow with 32-byte SSIDs" has been added to the 4.4-stable tree

PATCH [email protected] 1 participant 1 message Dec 4, 2016

Subsystems (2)
Stable branch Networking drivers (wireless)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

mwifiex: printk() overflow with 32-byte SSIDs

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mwifiex-printk-overflow-with-32-byte-ssids.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From fcd2042e8d36cf644bd2d69c26378d17158b17df Mon Sep 17 00:00:00 2001

From: Brian Norris <[email protected]>
Date: Tue, 8 Nov 2016 18:28:24 -0800
Subject: mwifiex: printk() overflow with 32-byte SSIDs

From: Brian Norris <[email protected]>

commit fcd2042e8d36cf644bd2d69c26378d17158b17df upstream.

SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length when we print them out.

This can be easily noticed by connecting to a network with a 32-octet SSID:

[ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to

'0123456789abcdef0123456789abcdef <uninitialized mem>' bssid xx:xx:xx:xx:xx:xx

Fixes 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by Brian Norris <[email protected]>
Acked-by Amitkumar Karwar <[email protected]>
Signed-off-by Kalle Valo <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/net/wireless/mwifiex/cfg80211.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/net/wireless/mwifiex/cfg80211.c +7 -6
@@ -2144,8 +2144,9 @@ done:
 			is_scanning_required = 1;
 		} else {
 			mwifiex_dbg(priv->adapter, MSG,
-				    "info: trying to associate to '%s' bssid %pM\n",
-				    (char *)req_ssid.ssid, bss->bssid);
+				    "info: trying to associate to '%.*s' bssid %pM\n",
+				    req_ssid.ssid_len, (char *)req_ssid.ssid,
+				    bss->bssid);
 			memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN);
 			break;
 		}

@@ -2202,8 +2203,8 @@ mwifiex_cfg80211_connect(struct wiphy *w
 	}
 
 	mwifiex_dbg(adapter, INFO,
-		    "info: Trying to associate to %s and bssid %pM\n",
-		    (char *)sme->ssid, sme->bssid);
+		    "info: Trying to associate to %.*s and bssid %pM\n",
+		    (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
 
 	ret = mwifiex_cfg80211_assoc(priv, sme->ssid_len, sme->ssid, sme->bssid,
 				     priv->bss_mode, sme->channel, sme, 0);

@@ -2333,8 +2334,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy
 	}
 
 	mwifiex_dbg(priv->adapter, MSG,
-		    "info: trying to join to %s and bssid %pM\n",
-		    (char *)params->ssid, params->bssid);
+		    "info: trying to join to %.*s and bssid %pM\n",
+		    params->ssid_len, (char *)params->ssid, params->bssid);
 
 	mwifiex_set_ibss_params(priv, params);

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/mwifiex-printk-overflow-with-32-byte-ssids.patch