diff options
| author |   Kees Cook <keescook@chromium.org> | 2021-06-17 10:15:22 -0700 |
|---|---|---|
| committer |   Kalle Valo <kvalo@codeaurora.org> | 2021-06-22 18:24:50 +0300 |
| commit | 59c668d700be72bdf76932f5a7db0af947ee0539 (patch) | |
| tree | bb8ec24736e54be97336efb3f1e4c38e0fb9620c /drivers/net/wireless/marvell/mwifiex/sta_cmd.c | |
| parent | rtlwifi: rtl8192de: Fully initialize curvecount_val (diff) | |
| download | linux-dev-59c668d700be72bdf76932f5a7db0af947ee0539.tar.xz linux-dev-59c668d700be72bdf76932f5a7db0af947ee0539.zip | |
mwifiex: Avoid memset() over-write of WEP key_material
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memset(), avoid intentionally writing across
neighboring array fields.
When preparing to call mwifiex_set_keyparamset_wep(), key_material is
treated very differently from its structure layout (which has only a
single struct mwifiex_ie_type_key_param_set). Instead, add a new type to
the union so memset() can correctly reason about the size of the
structure.
Note that the union ("params", 196 bytes) containing key_material was
not large enough to hold the target of this memset(): sizeof(struct
mwifiex_ie_type_key_param_set) == 60, NUM_WEP_KEYS = 4, so 240
bytes, or 44 bytes past the end of "params". The good news is that
it appears that the command buffer, as allocated, is 2048 bytes
(MWIFIEX_SIZE_OF_CMD_BUFFER), so no neighboring memory appears to be
getting clobbered.
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210617171522.3410951-1-keescook@chromium.org
Diffstat (limited to 'drivers/net/wireless/marvell/mwifiex/sta_cmd.c')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/sta_cmd.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c index d3a968ef21ef..48ea00da1fc9 100644 --- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c +++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c @@ -840,14 +840,15 @@ mwifiex_cmd_802_11_key_material_v1(struct mwifiex_private *priv, } if (!enc_key) { - memset(&key_material->key_param_set, 0, - (NUM_WEP_KEYS * - sizeof(struct mwifiex_ie_type_key_param_set))); + struct host_cmd_ds_802_11_key_material_wep *key_material_wep = + (struct host_cmd_ds_802_11_key_material_wep *)key_material; + memset(key_material_wep->key_param_set, 0, + sizeof(key_material_wep->key_param_set)); ret = mwifiex_set_keyparamset_wep(priv, - &key_material->key_param_set, + &key_material_wep->key_param_set[0], &key_param_len); cmd->size = cpu_to_le16(key_param_len + - sizeof(key_material->action) + S_DS_GEN); + sizeof(key_material_wep->action) + S_DS_GEN); return ret; } else memset(&key_material->key_param_set, 0, |