| From 02c8baecf5d8850dba40b47cdf003ed2e04e66dd Mon Sep 17 00:00:00 2001 |
| From: Dan Aloni <dan@aloni.org> |
| Date: Sat, 20 Jun 2009 16:32:22 +0300 |
| Subject: Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME |
| |
| From: Dan Aloni <dan@aloni.org> |
| |
| commit 02c8baecf5d8850dba40b47cdf003ed2e04e66dd upstream. |
| |
| I repeatedly get __stack_chk_fail panic()s with this driver before |
| applying the attached fix. |
| |
| ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and |
| on certain conditions, the concatenated string will be larger than IFNAMSIZ |
| including the terminating zero. |
| |
| length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17 |
| |
| This fix uses strl{cpy,cat} in addition to the reduction of the total |
| possible length of the output string by a char. |
| |
| It can be applied to 2.6.30-stable as well. |
| |
| Signed-off-by: Dan Aloni <dan@aloni.org> |
| Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c | 12 ++++++------ |
| 1 file changed, 6 insertions(+), 6 deletions(-) |
| |
| --- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c |
| +++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c |
| @@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee802 |
| struct iw_request_info *info, |
| union iwreq_data *wrqu, char *extra) |
| { |
| - strcpy(wrqu->name, "802.11"); |
| + strlcpy(wrqu->name, "802.11", IFNAMSIZ); |
| if(ieee->modulation & IEEE80211_CCK_MODULATION){ |
| - strcat(wrqu->name, "b"); |
| + strlcat(wrqu->name, "b", IFNAMSIZ); |
| if(ieee->modulation & IEEE80211_OFDM_MODULATION) |
| - strcat(wrqu->name, "/g"); |
| + strlcat(wrqu->name, "/g", IFNAMSIZ); |
| }else if(ieee->modulation & IEEE80211_OFDM_MODULATION) |
| - strcat(wrqu->name, "g"); |
| + strlcat(wrqu->name, "g", IFNAMSIZ); |
| |
| if((ieee->state == IEEE80211_LINKED) || |
| (ieee->state == IEEE80211_LINKED_SCANNING)) |
| - strcat(wrqu->name," linked"); |
| + strlcat(wrqu->name," link", IFNAMSIZ); |
| else if(ieee->state != IEEE80211_NOLINK) |
| - strcat(wrqu->name," link.."); |
| + strlcat(wrqu->name," .....", IFNAMSIZ); |
| |
| |
| return 0; |