lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.5 112/542] libertas: make lbs_ibss_join_existing() return error code on rates overflow
    Date
    From: Nicolai Stange <nstange@suse.de>

    [ Upstream commit 1754c4f60aaf1e17d886afefee97e94d7f27b4cb ]

    Commit e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss
    descriptor") introduced a bounds check on the number of supplied rates to
    lbs_ibss_join_existing() and made it to return on overflow.

    However, the aforementioned commit doesn't set the return value accordingly
    and thus, lbs_ibss_join_existing() would return with zero even though it
    failed.

    Make lbs_ibss_join_existing return -EINVAL in case the bounds check on the
    number of supplied rates fails.

    Fixes: e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss descriptor")
    Signed-off-by: Nicolai Stange <nstange@suse.de>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/marvell/libertas/cfg.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c
    index 68985d7663491..4e3de684928bf 100644
    --- a/drivers/net/wireless/marvell/libertas/cfg.c
    +++ b/drivers/net/wireless/marvell/libertas/cfg.c
    @@ -1786,6 +1786,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
    if (rates_max > MAX_RATES) {
    lbs_deb_join("invalid rates");
    rcu_read_unlock();
    + ret = -EINVAL;
    goto out;
    }
    rates = cmd.bss.rates;
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 16:51    [W:2.066 / U:1.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site