Fixes for 4.19

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.19/mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch b/queue-4.19/mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch
new file mode 100644 (file)
index 0000000..1b7c56a
--- /dev/null
+++ b/queue-4.19/mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch
@@ -0,0 +1,40 @@
+From dd5b86b718eb9d9624e0d0307a40364d9ee96d4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Dec 2020 16:48:01 +0800
+Subject: mwifiex: Fix possible buffer overflows in
+ mwifiex_cmd_802_11_ad_hoc_start
+
+From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
+
+[ Upstream commit 5c455c5ab332773464d02ba17015acdca198f03d ]
+
+mwifiex_cmd_802_11_ad_hoc_start() calls memcpy() without checking
+the destination size may trigger a buffer overflower,
+which a local user could use to cause denial of service
+or the execution of arbitrary code.
+Fix it by putting the length check before calling memcpy().
+
+Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201206084801.26479-1-ruc_zhangxiaohui@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/join.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
+index d87aeff70cefb..c2cb1e711c06e 100644
+--- a/drivers/net/wireless/marvell/mwifiex/join.c
++++ b/drivers/net/wireless/marvell/mwifiex/join.c
+@@ -877,6 +877,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
+ 
+       memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
+ 
++      if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
++              req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
+       memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
+ 
+       mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",
+-- 
+2.27.0
+

diff --git a/queue-4.19/series b/queue-4.19/series
index 4b69e73ba13246c4dbdf73c36d099d3442aea6be..a7976c14f278880320e21c6f2b5e3bf8f2a3ba62 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -5,3 +5,4 @@ dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_xlate.patch
 kdev_t-always-inline-major-minor-helper-functions.patch
 iio-imu-bmi160-fix-alignment-and-data-leak-issues.patch
 iio-magnetometer-mag3110-fix-alignment-and-data-leak-issues.patch
+mwifiex-fix-possible-buffer-overflows-in-mwifiex_cmd.patch