Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-05 03:21:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Staging: prevent rtl8192su from crashing dev_ioctl in SIOCGIWNAME

Browse Source 
(adapted from the rtl8187se patch)

ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.

    length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17

This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.

It can be applied to 2.6.30-stable as well.

Signed-off-by: Dan Aloni <dan@aloni.org>
Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Dan Aloni 2009-06-24 22:34:39 +03:00 committed by Greg Kroah-Hartman
parent 02c8baecf5
commit 91fca6da38
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
View File

@ -548,21 +548,21 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee,
struct iw_request_info *info,
union iwreq_data *wrqu, char *extra)
{
strcpy(wrqu->name, "802.11");
strlcpy(wrqu->name, "802.11", IFNAMSIZ);
if(ieee->modulation & IEEE80211_CCK_MODULATION){
strcat(wrqu->name, "b");
strlcat(wrqu->name, "b", IFNAMSIZ);
if(ieee->modulation & IEEE80211_OFDM_MODULATION)
strcat(wrqu->name, "/g");
strlcat(wrqu->name, "/g", IFNAMSIZ);
}else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
strcat(wrqu->name, "g");
strlcat(wrqu->name, "g", IFNAMSIZ);
if (ieee->mode & (IEEE_N_24G | IEEE_N_5G))
strcat(wrqu->name, "/n");
strlcat(wrqu->name, "/n", IFNAMSIZ);
if((ieee->state == IEEE80211_LINKED) ||
(ieee->state == IEEE80211_LINKED_SCANNING))
strcat(wrqu->name," linked");
strlcat(wrqu->name, " link", IFNAMSIZ);
else if(ieee->state != IEEE80211_NOLINK)
strcat(wrqu->name," link..");
strlcat(wrqu->name, " .....", IFNAMSIZ);
return 0;