Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME
authorDan Aloni <dan@aloni.org>
Sat, 20 Jun 2009 13:32:22 +0000 (16:32 +0300)
committerGreg Kroah-Hartman <gregkh@suse.de>
Sun, 12 Jul 2009 20:21:45 +0000 (13:21 -0700)
I repeatedly get __stack_chk_fail panic()s with this driver before
applying the attached fix.

ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.

    length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17

This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.

It can be applied to 2.6.30-stable as well.

Signed-off-by: Dan Aloni <dan@aloni.org>
Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c

index 93af37e2d31a0b453031ffff3c79f852f6d79022..54b4b718f84a5f09fa2cd3a491f423d781276bc7 100644 (file)
@@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee,
                             struct iw_request_info *info,
                             union iwreq_data *wrqu, char *extra)
 {
-       strcpy(wrqu->name, "802.11");
+       strlcpy(wrqu->name, "802.11", IFNAMSIZ);
        if(ieee->modulation & IEEE80211_CCK_MODULATION){
-               strcat(wrqu->name, "b");
+               strlcat(wrqu->name, "b", IFNAMSIZ);
                if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-                       strcat(wrqu->name, "/g");
+                       strlcat(wrqu->name, "/g", IFNAMSIZ);
        }else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-               strcat(wrqu->name, "g");
+               strlcat(wrqu->name, "g", IFNAMSIZ);
 
        if((ieee->state == IEEE80211_LINKED) ||
                (ieee->state == IEEE80211_LINKED_SCANNING))
-               strcat(wrqu->name," linked");
+               strlcat(wrqu->name,"  link", IFNAMSIZ);
        else if(ieee->state != IEEE80211_NOLINK)
-               strcat(wrqu->name," link..");
+               strlcat(wrqu->name," .....", IFNAMSIZ);
 
 
        return 0;