lkml.org 
[lkml]   [2020]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 004/245] libertas: make lbs_ibss_join_existing() return error code on rates overflow
    3.16.83-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Nicolai Stange <nstange@suse.de>

    commit 1754c4f60aaf1e17d886afefee97e94d7f27b4cb upstream.

    Commit e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss
    descriptor") introduced a bounds check on the number of supplied rates to
    lbs_ibss_join_existing() and made it to return on overflow.

    However, the aforementioned commit doesn't set the return value accordingly
    and thus, lbs_ibss_join_existing() would return with zero even though it
    failed.

    Make lbs_ibss_join_existing return -EINVAL in case the bounds check on the
    number of supplied rates fails.

    Fixes: e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss descriptor")
    Signed-off-by: Nicolai Stange <nstange@suse.de>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    [bwh: Backported to 3.16: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/net/wireless/libertas/cfg.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/drivers/net/wireless/libertas/cfg.c
    +++ b/drivers/net/wireless/libertas/cfg.c
    @@ -1856,6 +1856,7 @@ static int lbs_ibss_join_existing(struct
    if (rates_max > MAX_RATES) {
    lbs_deb_join("invalid rates");
    rcu_read_unlock();
    + ret = -EINVAL;
    goto out;
    }
    rates = cmd.bss.rates;
    \
     
     \ /
      Last update: 2020-04-24 01:26    [W:6.336 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site