Skip to content

Commit b91c911

Browse files
author
Weiguo Hu
committed
net: wireless: rockchip_wlan: realtek wifi: fix device_name and nego_ssid overflow in ioctl p2p interface
References: CNVD-C-2020-269231, CNVD-C-2020-269232 Signed-off-by: Weiguo Hu <hwg@rock-chips.com> Change-Id: I1e926e5c9673fbc141275a72284569179f630aba
1 parent f376895 commit b91c911

10 files changed

Lines changed: 50 additions & 0 deletions

File tree

‎drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4455,6 +4455,9 @@ static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
44554455
struct iw_point *pdata = &wrqu->data;
44564456
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
44574457

4458+
if (wrqu->data.length > WLAN_SSID_MAXLEN - 1)
4459+
return -EINVAL;
4460+
44584461
RTW_INFO("[%s] ssid = %s, len = %zu\n", __FUNCTION__, extra, strlen(extra));
44594462
_rtw_memcpy(pwdinfo->nego_ssid, extra, strlen(extra));
44604463
pwdinfo->nego_ssidlen = strlen(extra);
@@ -4599,6 +4602,8 @@ static int rtw_p2p_setDN(struct net_device *dev,
45994602
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
46004603
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
46014604

4605+
if (wrqu->data.length > WPS_MAX_DEVICE_NAME_LEN - 1)
4606+
return -EINVAL;
46024607

46034608
RTW_INFO("[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length - 1);
46044609
_rtw_memset(pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN);

‎drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4895,6 +4895,9 @@ static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
48954895
struct iw_point *pdata = &wrqu->data;
48964896
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
48974897

4898+
if (wrqu->data.length > WLAN_SSID_MAXLEN - 1)
4899+
return -EINVAL;
4900+
48984901
DBG_871X( "[%s] ssid = %s, len = %zu\n", __FUNCTION__, extra, strlen( extra ) );
48994902
_rtw_memcpy( pwdinfo->nego_ssid, extra, strlen( extra ) );
49004903
pwdinfo->nego_ssidlen = strlen( extra );
@@ -5060,6 +5063,8 @@ static int rtw_p2p_setDN(struct net_device *dev,
50605063
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
50615064
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
50625065

5066+
if (wrqu->data.length > WPS_MAX_DEVICE_NAME_LEN - 1)
5067+
return -EINVAL;
50635068

50645069
DBG_871X( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1 );
50655070
_rtw_memset( pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN );

‎drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4942,6 +4942,9 @@ static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
49424942
struct iw_point *pdata = &wrqu->data;
49434943
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
49444944

4945+
if (wrqu->data.length > WLAN_SSID_MAXLEN - 1)
4946+
return -EINVAL;
4947+
49454948
DBG_871X( "[%s] ssid = %s, len = %zu\n", __FUNCTION__, extra, strlen( extra ) );
49464949
_rtw_memcpy( pwdinfo->nego_ssid, extra, strlen( extra ) );
49474950
pwdinfo->nego_ssidlen = strlen( extra );
@@ -5107,6 +5110,8 @@ static int rtw_p2p_setDN(struct net_device *dev,
51075110
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
51085111
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
51095112

5113+
if (wrqu->data.length > WPS_MAX_DEVICE_NAME_LEN - 1)
5114+
return -EINVAL;
51105115

51115116
DBG_871X( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1 );
51125117
_rtw_memset( pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN );

‎drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_linux.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3946,6 +3946,9 @@ static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
39463946
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
39473947
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
39483948

3949+
if (wrqu->data.length > WLAN_SSID_MAXLEN - 1)
3950+
return -EINVAL;
3951+
39493952
RTW_INFO("[%s] ssid = %s, len = %zu\n", __FUNCTION__, extra, strlen(extra));
39503953
_rtw_memcpy(pwdinfo->nego_ssid, extra, strlen(extra));
39513954
pwdinfo->nego_ssidlen = strlen(extra);
@@ -4090,6 +4093,8 @@ static int rtw_p2p_setDN(struct net_device *dev,
40904093
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
40914094
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
40924095

4096+
if (wrqu->data.length > WPS_MAX_DEVICE_NAME_LEN - 1)
4097+
return -EINVAL;
40934098

40944099
RTW_INFO("[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length - 1);
40954100
_rtw_memset(pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN);

‎drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_linux.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4093,6 +4093,9 @@ static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
40934093
struct iw_point *pdata = &wrqu->data;
40944094
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
40954095

4096+
if (wrqu->data.length > WLAN_SSID_MAXLEN - 1)
4097+
return -EINVAL;
4098+
40964099
RTW_INFO("[%s] ssid = %s, len = %zu\n", __FUNCTION__, extra, strlen(extra));
40974100
_rtw_memcpy(pwdinfo->nego_ssid, extra, strlen(extra));
40984101
pwdinfo->nego_ssidlen = strlen(extra);
@@ -4237,6 +4240,8 @@ static int rtw_p2p_setDN(struct net_device *dev,
42374240
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
42384241
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
42394242

4243+
if (wrqu->data.length > WPS_MAX_DEVICE_NAME_LEN - 1)
4244+
return -EINVAL;
42404245

42414246
RTW_INFO("[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length - 1);
42424247
_rtw_memset(pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN);

‎drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4895,6 +4895,9 @@ static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
48954895
struct iw_point *pdata = &wrqu->data;
48964896
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
48974897

4898+
if (wrqu->data.length > WLAN_SSID_MAXLEN - 1)
4899+
return -EINVAL;
4900+
48984901
DBG_871X( "[%s] ssid = %s, len = %zu\n", __FUNCTION__, extra, strlen( extra ) );
48994902
_rtw_memcpy( pwdinfo->nego_ssid, extra, strlen( extra ) );
49004903
pwdinfo->nego_ssidlen = strlen( extra );
@@ -5060,6 +5063,8 @@ static int rtw_p2p_setDN(struct net_device *dev,
50605063
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
50615064
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
50625065

5066+
if (wrqu->data.length > WPS_MAX_DEVICE_NAME_LEN - 1)
5067+
return -EINVAL;
50635068

50645069
DBG_871X( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1 );
50655070
_rtw_memset( pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN );

‎drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4455,6 +4455,9 @@ static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
44554455
struct iw_point *pdata = &wrqu->data;
44564456
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
44574457

4458+
if (wrqu->data.length > WLAN_SSID_MAXLEN - 1)
4459+
return -EINVAL;
4460+
44584461
RTW_INFO("[%s] ssid = %s, len = %zu\n", __FUNCTION__, extra, strlen(extra));
44594462
_rtw_memcpy(pwdinfo->nego_ssid, extra, strlen(extra));
44604463
pwdinfo->nego_ssidlen = strlen(extra);
@@ -4599,6 +4602,8 @@ static int rtw_p2p_setDN(struct net_device *dev,
45994602
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
46004603
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
46014604

4605+
if (wrqu->data.length > WPS_MAX_DEVICE_NAME_LEN - 1)
4606+
return -EINVAL;
46024607

46034608
RTW_INFO("[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length - 1);
46044609
_rtw_memset(pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN);

‎drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_linux.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3952,6 +3952,9 @@ static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
39523952
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
39533953
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
39543954

3955+
if (wrqu->data.length > WLAN_SSID_MAXLEN - 1)
3956+
return -EINVAL;
3957+
39553958
RTW_INFO("[%s] ssid = %s, len = %zu\n", __FUNCTION__, extra, strlen(extra));
39563959
_rtw_memcpy(pwdinfo->nego_ssid, extra, strlen(extra));
39573960
pwdinfo->nego_ssidlen = strlen(extra);
@@ -4096,6 +4099,8 @@ static int rtw_p2p_setDN(struct net_device *dev,
40964099
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
40974100
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
40984101

4102+
if (wrqu->data.length > WPS_MAX_DEVICE_NAME_LEN - 1)
4103+
return -EINVAL;
40994104

41004105
RTW_INFO("[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length - 1);
41014106
_rtw_memset(pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN);

‎drivers/net/wireless/rockchip_wlan/rtl8821cs/os_dep/linux/ioctl_linux.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3946,6 +3946,9 @@ static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
39463946
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
39473947
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
39483948

3949+
if (wrqu->data.length > WLAN_SSID_MAXLEN - 1)
3950+
return -EINVAL;
3951+
39493952
RTW_INFO("[%s] ssid = %s, len = %zu\n", __FUNCTION__, extra, strlen(extra));
39503953
_rtw_memcpy(pwdinfo->nego_ssid, extra, strlen(extra));
39513954
pwdinfo->nego_ssidlen = strlen(extra);
@@ -4090,6 +4093,8 @@ static int rtw_p2p_setDN(struct net_device *dev,
40904093
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
40914094
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
40924095

4096+
if (wrqu->data.length > WPS_MAX_DEVICE_NAME_LEN - 1)
4097+
return -EINVAL;
40934098

40944099
RTW_INFO("[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length - 1);
40954100
_rtw_memset(pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN);

‎drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4519,6 +4519,9 @@ static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
45194519
struct iw_point *pdata = &wrqu->data;
45204520
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
45214521

4522+
if (wrqu->data.length > WLAN_SSID_MAXLEN - 1)
4523+
return -EINVAL;
4524+
45224525
RTW_INFO("[%s] ssid = %s, len = %zu\n", __FUNCTION__, extra, strlen(extra));
45234526
_rtw_memcpy(pwdinfo->nego_ssid, extra, strlen(extra));
45244527
pwdinfo->nego_ssidlen = strlen(extra);
@@ -4663,6 +4666,8 @@ static int rtw_p2p_setDN(struct net_device *dev,
46634666
_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
46644667
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
46654668

4669+
if (wrqu->data.length > WPS_MAX_DEVICE_NAME_LEN - 1)
4670+
return -EINVAL;
46664671

46674672
RTW_INFO("[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length - 1);
46684673
_rtw_memset(pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN);

0 commit comments

Comments
 (0)