forked from Minki/linux
b2271b5bdf
This patch fix following issues reported by Dan:-
1) There is no check limiting the size to 32 and it could be up to
253 bytes.
2) Use defines instead of magic numbers.
3) The oz_farewell struct is supposed to be a variable length struct
but the variable part is put in the middle. It doesn't make any
sense to put the length of the variable size array after then end
of the array because we can never find it again! Put the
variable size array at the end. Make it a zero length array.
u8 len;
u8 report[0];
4) In oz_add_farewell() we do this:
f = kmalloc(sizeof(struct oz_farewell) + len - 1, GFP_ATOMIC);
The "- 1" refers to sizeof(f->report) but because it was a magic
number then it was missed when the sizeof(f->report) changed.
5) In [patch 6/6] we set the ->len member. But because it is at the
end of a variable length array with no limit check the remote
attacker can just rewrite it using the memcpy() on the next line.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rupesh Gujare <rupesh.gujare@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| ozappif.h | ||
| ozcdev.c | ||
| ozcdev.h | ||
| ozdbg.h | ||
| ozeltbuf.c | ||
| ozeltbuf.h | ||
| ozhcd.c | ||
| ozhcd.h | ||
| ozmain.c | ||
| ozpd.c | ||
| ozpd.h | ||
| ozproto.c | ||
| ozproto.h | ||
| ozprotocol.h | ||
| ozurbparanoia.c | ||
| ozurbparanoia.h | ||
| ozusbif.h | ||
| ozusbsvc1.c | ||
| ozusbsvc.c | ||
| ozusbsvc.h | ||
| README | ||
| TODO | ||
OZWPAN USB Host Controller Driver --------------------------------- This driver is a USB HCD driver that does not have an associated a physical device but instead uses Wi-Fi to communicate with the wireless peripheral. The USB requests are converted into a layer 2 network protocol and transmitted on the network using an ethertype (0x892e) regestered to Ozmo Device Inc. This driver is compatible with existing wireless devices that use Ozmo Devices technology. To operate the driver must be bound to a suitable network interface. This can be done when the module is loaded (specifying the name of the network interface as a parameter - e.g. 'insmod ozwpan g_net_dev=go0') or can be bound after loading using an ioctl call. See the ozappif.h file and the ioctls OZ_IOCTL_ADD_BINDING and OZ_IOCTL_REMOVE_BINDING. The devices connect to the host use Wi-Fi Direct so a network card that supports Wi-Fi direct is required. A recent version (0.8.x or later) version of the wpa_supplicant can be used to setup the network interface to create a persistent autonomous group (for older pre-WFD peripherals) or put in a listen state to allow group negotiation to occur for more recent devices that support WFD. The protocol used over the network does not directly mimic the USB bus transactions as this would be rather busy and inefficient. Instead the chapter 9 requests are converted into a request/response pair of messages. (See ozprotocol.h for data structures used in the protocol).