From patchwork Tue Feb 12 18:11:38 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luciano Coelho X-Patchwork-Id: 2130361 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 68D03E00C6 for ; Tue, 12 Feb 2013 18:12:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933645Ab3BLSMo (ORCPT ); Tue, 12 Feb 2013 13:12:44 -0500 Received: from comal.ext.ti.com ([198.47.26.152]:42794 "EHLO comal.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933109Ab3BLSMn (ORCPT ); Tue, 12 Feb 2013 13:12:43 -0500 Received: from dlelxv30.itg.ti.com ([172.17.2.17]) by comal.ext.ti.com (8.13.7/8.13.7) with ESMTP id r1CICc9l005555; Tue, 12 Feb 2013 12:12:38 -0600 Received: from DFLE72.ent.ti.com (dfle72.ent.ti.com [128.247.5.109]) by dlelxv30.itg.ti.com (8.13.8/8.13.8) with ESMTP id r1CICcOM019915; Tue, 12 Feb 2013 12:12:38 -0600 Received: from dlelxv22.itg.ti.com (172.17.1.197) by dfle72.ent.ti.com (128.247.5.109) with Microsoft SMTP Server id 14.1.323.3; Tue, 12 Feb 2013 12:12:38 -0600 Received: from cumari.coelho.fi (h79-7.vpn.ti.com [172.24.79.7]) by dlelxv22.itg.ti.com (8.13.8/8.13.8) with ESMTP id r1CICa20027648; Tue, 12 Feb 2013 12:12:37 -0600 From: Luciano Coelho To: CC: , Subject: [PATCH] cfg80211: check vendor IE length to avoid overrun Date: Tue, 12 Feb 2013 20:11:38 +0200 Message-ID: <1360692698-24208-1-git-send-email-coelho@ti.com> X-Mailer: git-send-email 1.7.10.4 MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org cfg80211_find_vendor_ie() was checking only that the vendor IE would fit in the remaining IEs buffer. If a corrupt includes a vendor IE that is too small, we could potentially overrun the IEs buffer. Fix this by checking that the vendor IE fits in the reported IE length field and skip it otherwise. Reported-by: Jouni Malinen Cc: Johannes Berg Signed-off-by: Luciano Coelho --- net/wireless/scan.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 45f1618..4582801 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -277,14 +277,18 @@ const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type, if (!pos) return NULL; - if (end - pos < sizeof(*ie)) - return NULL; - ie = (struct ieee80211_vendor_ie *)pos; + + /* make sure we can access ie->len */ + BUILD_BUG_ON(offsetof(struct ieee80211_vendor_ie, len) >= 2); + + if (ie->len < sizeof(*ie)) + goto cont; + ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2]; if (ie_oui == oui && ie->oui_type == oui_type) return pos; - +cont: pos += 2 + ie->len; } return NULL;