Skip to contentSkip to conversation

staging: ath6kl: buffer overflow in SEND_FRAME ioctl

PATCH In review Dan Carpenter 4 participants 4 messages Feb 20, 2011 – Feb 23, 2011

Subsystems (2)
Staging Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 2/2 staging: ath6kl: buffer overflow in SEND_FRAME ioctl

We should check that optTxFrmCmd.optIEDataLen isn't too large before we copy it into the data buffer.

Signed-off-by Dan Carpenter <[email protected]>
drivers/staging/ath6kl/os/linux/ioctl.c +5 -0
index 17ba543..9a9a324 100644
@@ -3153,6 +3153,11 @@ int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 break;
             }
 
+            if (optTxFrmCmd.optIEDataLen > MAX_OPT_DATA_LEN) {
+                ret = -EINVAL;
+                break;
+            }
+
             if (copy_from_user(data, userdata+sizeof(WMI_OPT_TX_FRAME_CMD) - 1,
                                    optTxFrmCmd.optIEDataLen)) {
                 ret = -EFAULT;
Acked-by on v1 2/2
#1 lore raw

Re: [patch 2/2] staging: ath6kl: buffer overflow in SEND_FRAME

Quoted 11 lines · Dan Carpenter

We should check that optTxFrmCmd.optIEDataLen isn't too large before we copy it into the data buffer.

Signed-off-by Dan Carpenter <[email protected]>
drivers/staging/ath6kl/os/linux/ioctl.c +0 -0
index 17ba543..9a9a324 100644
@@ -3153,6 +3153,11 @@ int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 break;

drivers/staging/ath6kl/os/linux/ioctl.c int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) · line 3163

Quoted 10 lines
drivers/staging/ath6kl/os/linux/ioctl.c +5 -0
             }
 
+            if (optTxFrmCmd.optIEDataLen > MAX_OPT_DATA_LEN) {
+                ret = -EINVAL;
+                break;
+            }
+
             if (copy_from_user(data, userdata+sizeof(WMI_OPT_TX_FRAME_CMD) - 1,
                                    optTxFrmCmd.optIEDataLen)) {
                 ret = -EFAULT;
Acked-by Vipin Mehta <[email protected]>
#2 lore raw
In reply to Dan Carpenter
Quoted 1 line · Vipin Mehta
Acked-by Vipin Mehta <[email protected]>

Greg, Joe is not sure if these patches will be applied as-is and his cleanup depends on code being static, I think they would be there is a chance you might muck them a bit and this would break any cleanup work. Will these patches be merged as-is, can Joe for example git am these into his tree as-is and work off of the assumption that they will reflect the top of staging-next + these patches?

Luis

#3 lore raw
In reply to Dan Carpenter
Quoted 10 lines · Luis R. Rodriguez
Quoted 1 line · Vipin Mehta
Acked-by Vipin Mehta <[email protected]>

Greg, Joe is not sure if these patches will be applied as-is and his cleanup depends on code being static, I think they would be there is a chance you might muck them a bit and this would break any cleanup work. Will these patches be merged as-is, can Joe for example git am these into his tree as-is and work off of the assumption that they will reflect the top of staging-next + these patches?

I already answered Joe about this yesterday, was that response somehow not sufficient?

thanks,

greg "tired of repeating myself" k-h