nl80211: fix overflow in ssid_len (57a27e1d) · Commits · 戴 / test

When one of the SSID's length passed in a scan or sched_scan request is larger than 255, there will be an overflow in the u8 that is used to store the length before checking. This causes the check to fail and we overrun the buffer when copying the SSID. Fix this by checking the nl80211 attribute length before copying it to the struct. This is a follow up for the previous commit , which didn't fix the problem entirely. Reported-by:

Ido Yariv <ido@wizery.com> Signed-off-by:

Luciano Coelho <coelho@ti.com> Signed-off-by:

John W. Linville <linville@tuxdriver.com>

net/wireless/nl80211.c

+4 −5

Original line number	Diff line number	Diff line
		@@ -3406,11 +3406,11 @@ static int nl80211_trigger_scan(struct sk_buff skb, struct genl_info info)
		i = 0;
		if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
		request->ssids[i].ssid_len = nla_len(attr);
		if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
		if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
		err = -EINVAL;
		goto out_free;
		}
		request->ssids[i].ssid_len = nla_len(attr);
		memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
		i++;
		}
		@@ -3572,12 +3572,11 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
		if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
		tmp) {
		request->ssids[i].ssid_len = nla_len(attr);
		if (request->ssids[i].ssid_len >
		IEEE80211_MAX_SSID_LEN) {
		if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
		err = -EINVAL;
		goto out_free;
		}
		request->ssids[i].ssid_len = nla_len(attr);
		memcpy(request->ssids[i].ssid, nla_data(attr),
		nla_len(attr));
		i++;

Admin message