Commit 02c8baec authored by Dan Aloni's avatar Dan Aloni Committed by Greg Kroah-Hartman

Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME

I repeatedly get __stack_chk_fail panic()s with this driver before
applying the attached fix.

ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.

    length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17

This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.

It can be applied to 2.6.30-stable as well.
Signed-off-by: default avatarDan Aloni <dan@aloni.org>
Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 77b92881
...@@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee, ...@@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee,
struct iw_request_info *info, struct iw_request_info *info,
union iwreq_data *wrqu, char *extra) union iwreq_data *wrqu, char *extra)
{ {
strcpy(wrqu->name, "802.11"); strlcpy(wrqu->name, "802.11", IFNAMSIZ);
if(ieee->modulation & IEEE80211_CCK_MODULATION){ if(ieee->modulation & IEEE80211_CCK_MODULATION){
strcat(wrqu->name, "b"); strlcat(wrqu->name, "b", IFNAMSIZ);
if(ieee->modulation & IEEE80211_OFDM_MODULATION) if(ieee->modulation & IEEE80211_OFDM_MODULATION)
strcat(wrqu->name, "/g"); strlcat(wrqu->name, "/g", IFNAMSIZ);
}else if(ieee->modulation & IEEE80211_OFDM_MODULATION) }else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
strcat(wrqu->name, "g"); strlcat(wrqu->name, "g", IFNAMSIZ);
if((ieee->state == IEEE80211_LINKED) || if((ieee->state == IEEE80211_LINKED) ||
(ieee->state == IEEE80211_LINKED_SCANNING)) (ieee->state == IEEE80211_LINKED_SCANNING))
strcat(wrqu->name," linked"); strlcat(wrqu->name," link", IFNAMSIZ);
else if(ieee->state != IEEE80211_NOLINK) else if(ieee->state != IEEE80211_NOLINK)
strcat(wrqu->name," link.."); strlcat(wrqu->name," .....", IFNAMSIZ);
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment