Fixes for 5.10

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.10/mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch b/queue-5.10/mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch
new file mode 100644 (file)
index 0000000..04508d3
--- /dev/null
+++ b/queue-5.10/mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch
@@ -0,0 +1,40 @@
+From 7f81f17089ae0699f1af85cc1b4ff48f7c6f3236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Dec 2020 16:48:01 +0800
+Subject: mwifiex: Fix possible buffer overflows in
+ mwifiex_cmd_802_11_ad_hoc_start
+
+From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
+
+[ Upstream commit 5c455c5ab332773464d02ba17015acdca198f03d ]
+
+mwifiex_cmd_802_11_ad_hoc_start() calls memcpy() without checking
+the destination size may trigger a buffer overflower,
+which a local user could use to cause denial of service
+or the execution of arbitrary code.
+Fix it by putting the length check before calling memcpy().
+
+Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201206084801.26479-1-ruc_zhangxiaohui@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/join.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
+index 5934f71475477..173ccf79cbfcc 100644
+--- a/drivers/net/wireless/marvell/mwifiex/join.c
++++ b/drivers/net/wireless/marvell/mwifiex/join.c
+@@ -877,6 +877,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
+ 
+       memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
+ 
++      if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
++              req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
+       memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
+ 
+       mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",
+-- 
+2.27.0
+

diff --git a/queue-5.10/series b/queue-5.10/series
index 7de2d7059d5542d8e11fcd69b308a90da677a97d..0c6550c50547935d047b5e118a4b821b3ee7ac58 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -17,3 +17,4 @@ perf-break-deadlock-involving-exec_update_mutex.patch
 rwsem-implement-down_read_killable_nested.patch
 rwsem-implement-down_read_interruptible.patch
 exec-transform-exec_update_mutex-into-a-rw_semaphore.patch
+mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch