From patchwork Thu Oct 13 17:52:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 2268 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp414877wrs; Thu, 13 Oct 2022 11:16:23 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5W1Yp2MnnjY/mx2SrrMNIimhIlN11i6ICBv7Zlp9C/y5j3ZmIRd1x1O/qci5BWIaxU7DHv X-Received: by 2002:a17:903:2d1:b0:183:2b26:575d with SMTP id s17-20020a17090302d100b001832b26575dmr978956plk.77.1665684982943; Thu, 13 Oct 2022 11:16:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665684982; cv=none; d=google.com; s=arc-20160816; b=b680fiWSkOxbtmRsYrfa+3n8wNrhPm+8K6GnJHvveWrqmqjkDCGnHKxzNCzb24hOLN D2qXd95J/NaT/NrFex3ng8zwZcKfG5/FDWC0OwYA815mC2cZSE+l/O/qTZ3WgJuJ65uH iiyzRvWnO3gTftTRmz1CY5TgKso9JZy7a2PWhsdgmR3NfP2I6OngbRm8KweVUM4jHKu1 2q9n1R/CRBiC5cJmAsRfcHnsltEk60wsx0eUTu7hzvibTmekqHcy3Ap0PbBWdm2T0/kp 3h9I1X/zNpkxan6XF/sr2KfCLq6xn+hnY8brO8dLU5rayvcvRsnX2R9OldTdcp7pXfD4 pJEw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=ek4IOQ2Vw+tVTR7ZdXdlL2dAUPCNm5z6ll38c5AkmnU=; b=NPh+gIV4Omy3RE46x8WtV183nX2XgN3lxV5/q0KQ52ipPEHuNLDAyVU+36OUI3kZaZ W8Y8Enb2s2ClOjbwpGFmXvdBI0qQHXW3PNY7DDn1Rf9Fovn5yduIJfttduROAVZwxh+V wdXXOP1FLtQxMgG+LGji63XD3ir/C4TfUZ283HtaoL8xrQhIKPkn3wLKjEh0S82eVGaG i70q5oX/9XgrjXxhEZ2pktp7ZlDqZW9PvfCZpECkt6yfIj3jV8zUgSCkAdKgBlK2qhIc bfnUMhHXhDBQg7elQkJpMVpqGxh1HLuLo42enYdZHu3n2sijFua3ORIIi0AeTW2nVTV7 jNgA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=aurWYMP6; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s9-20020a17090302c900b0017f5ea214a8si376492plk.462.2022.10.13.11.16.10; Thu, 13 Oct 2022 11:16:22 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=aurWYMP6; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231678AbiJMSPr (ORCPT + 99 others); Thu, 13 Oct 2022 14:15:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39072 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231838AbiJMSMx (ORCPT ); Thu, 13 Oct 2022 14:12:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF619B1C8; Thu, 13 Oct 2022 11:09:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4A1A9B82020; Thu, 13 Oct 2022 17:57:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA6F0C433C1; Thu, 13 Oct 2022 17:57:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665683861; bh=r9PM8b6YrYqEAMH8Yyhr2eZC2Q2EKssexz0N1yrdbq8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aurWYMP6g4VvU3Io4HXTAzU1l49APAKD1xZjBunXOnPGWFarBkvlqiCVx6XQEH9cz Wfw+wj2h4n2zzqFL0I/RHBEMd8GlPCe8+6yq8xgBNt4HKejm+gaBVKasNnswnCDqIh 5QgCPW1d1vU/ZKBurEEthSMpIsTC5PiV9zEkVdGk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Soenke Huster , Kees Cook , Johannes Berg Subject: [PATCH 5.15 16/27] wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() Date: Thu, 13 Oct 2022 19:52:45 +0200 Message-Id: <20221013175144.139483450@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175143.518476113@linuxfoundation.org> References: <20221013175143.518476113@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746597297006178569?= X-GMAIL-MSGID: =?utf-8?q?1746597297006178569?= From: Johannes Berg commit aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d upstream. In the copy code of the elements, we do the following calculation to reach the end of the MBSSID element: /* copy the IEs after MBSSID */ cpy_len = mbssid[1] + 2; This looks fine, however, cpy_len is a u8, the same as mbssid[1], so the addition of two can overflow. In this case the subsequent memcpy() will overflow the allocated buffer, since it copies 256 bytes too much due to the way the allocation and memcpy() sizes are calculated. Fix this by using size_t for the cpy_len variable. This fixes CVE-2022-41674. Reported-by: Soenke Huster Tested-by: Soenke Huster Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") Reviewed-by: Kees Cook Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -2238,7 +2238,7 @@ cfg80211_update_notlisted_nontrans(struc size_t new_ie_len; struct cfg80211_bss_ies *new_ies; const struct cfg80211_bss_ies *old; - u8 cpy_len; + size_t cpy_len; lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);