Fixes for 4.14

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.14/mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch b/queue-4.14/mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch
new file mode 100644 (file)
index 0000000..8ad3275
--- /dev/null
+++ b/queue-4.14/mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch
@@ -0,0 +1,40 @@
+From 83776a877bb3742a935633da98cf85e5e07d8861 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Dec 2020 16:48:01 +0800
+Subject: mwifiex: Fix possible buffer overflows in
+ mwifiex_cmd_802_11_ad_hoc_start
+
+From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
+
+[ Upstream commit 5c455c5ab332773464d02ba17015acdca198f03d ]
+
+mwifiex_cmd_802_11_ad_hoc_start() calls memcpy() without checking
+the destination size may trigger a buffer overflower,
+which a local user could use to cause denial of service
+or the execution of arbitrary code.
+Fix it by putting the length check before calling memcpy().
+
+Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201206084801.26479-1-ruc_zhangxiaohui@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/join.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
+index d87aeff70cefb..c2cb1e711c06e 100644
+--- a/drivers/net/wireless/marvell/mwifiex/join.c
++++ b/drivers/net/wireless/marvell/mwifiex/join.c
+@@ -877,6 +877,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
+ 
+       memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
+ 
++      if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
++              req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
+       memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
+ 
+       mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",
+-- 
+2.27.0
+

diff --git a/queue-4.14/series b/queue-4.14/series
index a68bd1da425ff2d6b0ca1ce6b0c367a3742cbf46..681379bde866c1531ceb17cb46e11152cfe6c581 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -26,3 +26,4 @@ dm-verity-skip-verity-work-if-i-o-error-when-system-.patch
 kdev_t-always-inline-major-minor-helper-functions.patch
 iio-imu-bmi160-fix-alignment-and-data-leak-issues.patch
 iio-magnetometer-mag3110-fix-alignment-and-data-leak-issues.patch
+mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch