From patchwork Thu Oct 13 17:52:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 2203 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp410371wrs; Thu, 13 Oct 2022 11:06:27 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7c9oTaWItIbTSh6vr8O46Vh62eII91DrfRrpmkOiPzVDd4coeztlvt9PMiSOMhZ5xUtmYp X-Received: by 2002:a05:6a00:21c8:b0:52e:3404:eba5 with SMTP id t8-20020a056a0021c800b0052e3404eba5mr1006904pfj.67.1665684387223; Thu, 13 Oct 2022 11:06:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665684387; cv=none; d=google.com; s=arc-20160816; b=OvXE/e222M/8ZxUc5NrWLQ+cL1VvaCTbTkkdaTZJE/0lNX4cce6J53aEdjUcI2gAqU rNKqWCepqB8eHOSaVK3qgnB4OObCOAT50QrhWbbz1Xr1Osjf7pWmxy5W+P3p1hTvVoh6 mQj005o4wIRstFym8f2sY8QUYvsWS60mDVExIZ3+LtEvow/vm/DuIu3oavleiOM1u5vA Knq2ECmfpOUpx6N2tdzkCjXARrTCT9JFDlgGZozATNii30HBtXP3W9XCfv23mGFSbU2c /HhQoJ6tQK4usJihZJ1vCLkzMxsqYJNB5hwXKzKY1qsl3RuvytbEZ6WeiQGFLw1I2oPG JzVA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=omKlhbk9CSOQdNNWLr6ptpJ5xIvt1ml7n0StJ8XC+N0=; b=OwIprrTfGfLlLJlV/2/0SmsFSfaX2FRIp1IziPgPXvr1RrpK/MwC8ILReCxHSxaYTS 0u71mhT0cI3itn5lzyeNCmz5GHQQvSDTP8M0/+PpPcxVdWvf7+zVlgLB7Vn3CT7yx+07 7GxQGcTHNTzn+RetoC73ZObWkYgrqUwBLQH+B9aTfm6Yzw74Mj2BwRH/oZlzUdQpdq9c SI9ULvtXXlumxRpAKNz9sp877EnaswrBM959KvOZy8vtMmUfn9m7UW7WvtlIlRptLaY3 xpoMhZ60atpGE8TfLgpVpWRo0jf7NJjJSi5LNjYK1wjljglqHdC34vfsFF6IMQlFN5tG 4JDw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=L9sSsano; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d1-20020a170902cec100b0016d7c6223cdsi487297plg.261.2022.10.13.11.06.14; Thu, 13 Oct 2022 11:06:27 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=L9sSsano; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231331AbiJMSFx (ORCPT + 99 others); Thu, 13 Oct 2022 14:05:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231191AbiJMSDk (ORCPT ); Thu, 13 Oct 2022 14:03:40 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 21298157F67; Thu, 13 Oct 2022 11:03:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A8C256192C; Thu, 13 Oct 2022 18:00:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BA7EFC433D6; Thu, 13 Oct 2022 18:00:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665684029; bh=yO7jB7qJ3SzvXbCw+6Kqc+Vb9MrWMZHZx+fu+glnvtQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L9sSsanom39si1D52rxNAjy+/eOpMiSssQb1LvxTpnHby3Qai1tMaCGA5iRQDvVbp ItI/CyySBMlmQweTK7XPqnp6oIIT3+KLK60U8261/V78bvjr4Ix8lMuSLkwer3uI+G ldgi4CQKL8KPNiCcZ3+xlGVDviM+Ffu+ub1Xb5UQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Soenke Huster , Kees Cook , Johannes Berg Subject: [PATCH 5.19 20/33] wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() Date: Thu, 13 Oct 2022 19:52:52 +0200 Message-Id: <20221013175145.955718271@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175145.236739253@linuxfoundation.org> References: <20221013175145.236739253@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746596671862143573?= X-GMAIL-MSGID: =?utf-8?q?1746596671862143573?= From: Johannes Berg commit aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d upstream. In the copy code of the elements, we do the following calculation to reach the end of the MBSSID element: /* copy the IEs after MBSSID */ cpy_len = mbssid[1] + 2; This looks fine, however, cpy_len is a u8, the same as mbssid[1], so the addition of two can overflow. In this case the subsequent memcpy() will overflow the allocated buffer, since it copies 256 bytes too much due to the way the allocation and memcpy() sizes are calculated. Fix this by using size_t for the cpy_len variable. This fixes CVE-2022-41674. Reported-by: Soenke Huster Tested-by: Soenke Huster Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") Reviewed-by: Kees Cook Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -2279,7 +2279,7 @@ cfg80211_update_notlisted_nontrans(struc size_t new_ie_len; struct cfg80211_bss_ies *new_ies; const struct cfg80211_bss_ies *old; - u8 cpy_len; + size_t cpy_len; lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);