From patchwork Fri Mar 15 16:36:24 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luca Coelho X-Patchwork-Id: 10855199 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 79FEF1515 for ; Fri, 15 Mar 2019 16:36:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 62A5B2AACA for ; Fri, 15 Mar 2019 16:36:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 56F6A2AB2B; Fri, 15 Mar 2019 16:36:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D94242AACA for ; Fri, 15 Mar 2019 16:36:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729535AbfCOQgs (ORCPT ); Fri, 15 Mar 2019 12:36:48 -0400 Received: from paleale.coelho.fi ([176.9.41.70]:44268 "EHLO farmhouse.coelho.fi" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1728171AbfCOQgr (ORCPT ); Fri, 15 Mar 2019 12:36:47 -0400 Received: from 91-156-6-193.elisa-laajakaista.fi ([91.156.6.193] helo=redipa.ger.corp.intel.com) by farmhouse.coelho.fi with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.91) (envelope-from ) id 1h4pp7-0004qp-NR; Fri, 15 Mar 2019 18:36:46 +0200 From: Luca Coelho To: kvalo@codeaurora.org Cc: linux-wireless@vger.kernel.org, Luca Coelho Date: Fri, 15 Mar 2019 18:36:24 +0200 Message-Id: <20190315163634.17315-7-luca@coelho.fi> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190315163634.17315-1-luca@coelho.fi> References: <20190315163634.17315-1-luca@coelho.fi> MIME-Version: 1.0 Subject: [PATCH 06/16] mac80211_hwsim: make copying of ciphers safer by checking the length Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Luca Coelho Make sure the length of the ciphers we are copying never exceeds the space we have for storing them. There is no risk of overcopying at the moment, because we check n_params before, but this makes this function safer in case someone changes something in the future. Signed-off-by: Luca Coelho --- drivers/net/wireless/mac80211_hwsim.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c index 0838af04d681..809a75357113 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -3,7 +3,7 @@ * Copyright (c) 2008, Jouni Malinen * Copyright (c) 2011, Javier Lopez * Copyright (c) 2016 - 2017 Intel Deutschland GmbH - * Copyright (C) 2018 Intel Corporation + * Copyright (C) 2018 - 2019 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -2776,10 +2776,14 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, hw->wiphy->n_iface_combinations = 1; if (param->ciphers) { - memcpy(data->ciphers, param->ciphers, - param->n_ciphers * sizeof(u32)); + int ciphers_len = param->n_ciphers * sizeof(data->ciphers[0]); + + if (WARN_ON_ONCE(ciphers_len > sizeof(data->ciphers))) + ciphers_len = sizeof(data->ciphers); + + memcpy(data->ciphers, param->ciphers, ciphers_len); hw->wiphy->cipher_suites = data->ciphers; - hw->wiphy->n_cipher_suites = param->n_ciphers; + hw->wiphy->n_cipher_suites = ciphers_len / sizeof(data->ciphers[0]); } INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);