From patchwork Fri Mar 15 15:38:59 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luca Coelho X-Patchwork-Id: 10855059 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 30C4A17EF for ; Fri, 15 Mar 2019 15:39:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1418E2AAF4 for ; Fri, 15 Mar 2019 15:39:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 059FE2AAF3; Fri, 15 Mar 2019 15:39:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A760B29E78 for ; Fri, 15 Mar 2019 15:39:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729358AbfCOPjR (ORCPT ); Fri, 15 Mar 2019 11:39:17 -0400 Received: from paleale.coelho.fi ([176.9.41.70]:44094 "EHLO farmhouse.coelho.fi" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1729313AbfCOPjR (ORCPT ); Fri, 15 Mar 2019 11:39:17 -0400 Received: from 91-156-6-193.elisa-laajakaista.fi ([91.156.6.193] helo=redipa.ger.corp.intel.com) by farmhouse.coelho.fi with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.91) (envelope-from ) id 1h4ovT-0004n1-ND; Fri, 15 Mar 2019 17:39:16 +0200 From: Luca Coelho To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Luca Coelho Date: Fri, 15 Mar 2019 17:38:59 +0200 Message-Id: <20190315153907.16192-4-luca@coelho.fi> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190315153907.16192-1-luca@coelho.fi> References: <20190315153907.16192-1-luca@coelho.fi> MIME-Version: 1.0 Subject: [PATCH 03/11] nl80211: copy the length of dst of src in nl80211_notify_radar_detection() Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Luca Coelho It is generally safer to copy the length of the destination instead of the length of the source, because if the sizes don't match, it's usually better to leak some data from the source than to write data out of bounds in the destination. Signed-off-by: Luca Coelho --- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 25a9e3b5c154..239be0e2f9e1 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -8061,7 +8061,7 @@ static int nl80211_notify_radar_detection(struct sk_buff *skb, cfg80211_sched_dfs_chan_update(rdev); - memcpy(&rdev->radar_chandef, &chandef, sizeof(chandef)); + memcpy(&rdev->radar_chandef, &chandef, sizeof(rdev->radar_chandef)); /* Propagate this notification to other radios as well */ queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);