From 0a9b92020d755c4c7a50c7b4b9a0fa047e393083 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Wed, 18 Aug 2021 01:19:37 -0700 Subject: staging: wlan-ng: Disable buggy MIB ioctl struct hfa384x_wpa_data ends with a flexible array, but it is allocated on the stack. This means it can never hold any data. Disable the memcpy() calls in and out of the structure, since it must always be zero. This could never have worked. Cc: Greg Kroah-Hartman Cc: Igor Matheus Andrade Torrente Cc: linux-staging@lists.linux.dev Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20210818081937.1668775-1-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman --- drivers/staging/wlan-ng/prism2mib.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'drivers/staging') diff --git a/drivers/staging/wlan-ng/prism2mib.c b/drivers/staging/wlan-ng/prism2mib.c index 875812a391c9..d14f032a7ed6 100644 --- a/drivers/staging/wlan-ng/prism2mib.c +++ b/drivers/staging/wlan-ng/prism2mib.c @@ -668,6 +668,10 @@ static int prism2mib_priv(struct mibrec *mib, switch (mib->did) { case DIDMIB_LNX_CONFIGTABLE_RSNAIE: { + /* + * This can never work: wpa is on the stack + * and has no bytes allocated in wpa.data. + */ struct hfa384x_wpa_data wpa; if (isget) { @@ -675,11 +679,17 @@ static int prism2mib_priv(struct mibrec *mib, HFA384x_RID_CNFWPADATA, (u8 *)&wpa, sizeof(wpa)); + /* pstr->len = le16_to_cpu(wpa.datalen); memcpy(pstr->data, wpa.data, pstr->len); + */ + pstr->len = 0; } else { + /* wpa.datalen = cpu_to_le16(pstr->len); memcpy(wpa.data, pstr->data, pstr->len); + */ + wpa.datalen = 0; hfa384x_drvr_setconfig(hw, HFA384x_RID_CNFWPADATA, -- cgit v1.2.3