| From foo@baz Mon Apr 9 17:09:24 CEST 2018 |
| From: Kees Cook <keescook@chromium.org> |
| Date: Fri, 5 May 2017 15:38:41 -0700 |
| Subject: ray_cs: Avoid reading past end of buffer |
| |
| From: Kees Cook <keescook@chromium.org> |
| |
| |
| [ Upstream commit e48d661eb13f2f83861428f001c567fdb3f317e8 ] |
| |
| Using memcpy() from a buffer that is shorter than the length copied means |
| the destination buffer is being filled with arbitrary data from the kernel |
| rodata segment. In this case, the source was made longer, since it did not |
| match the destination structure size. Additionally removes a needless cast. |
| |
| This was found with the future CONFIG_FORTIFY_SOURCE feature. |
| |
| Cc: Daniel Micay <danielmicay@gmail.com> |
| Signed-off-by: Kees Cook <keescook@chromium.org> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/wireless/ray_cs.c | 7 +++++-- |
| 1 file changed, 5 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/net/wireless/ray_cs.c |
| +++ b/drivers/net/wireless/ray_cs.c |
| @@ -247,7 +247,10 @@ static const UCHAR b4_default_startup_pa |
| 0x04, 0x08, /* Noise gain, limit offset */ |
| 0x28, 0x28, /* det rssi, med busy offsets */ |
| 7, /* det sync thresh */ |
| - 0, 2, 2 /* test mode, min, max */ |
| + 0, 2, 2, /* test mode, min, max */ |
| + 0, /* rx/tx delay */ |
| + 0, 0, 0, 0, 0, 0, /* current BSS id */ |
| + 0 /* hop set */ |
| }; |
| |
| /*===========================================================================*/ |
| @@ -598,7 +601,7 @@ static void init_startup_params(ray_dev_ |
| * a_beacon_period = hops a_beacon_period = KuS |
| *//* 64ms = 010000 */ |
| if (local->fw_ver == 0x55) { |
| - memcpy((UCHAR *) &local->sparm.b4, b4_default_startup_parms, |
| + memcpy(&local->sparm.b4, b4_default_startup_parms, |
| sizeof(struct b4_startup_params)); |
| /* Translate sane kus input values to old build 4/5 format */ |
| /* i = hop time in uS truncated to 3 bytes */ |
