[PATCH] ray_cs: Avoid reading past end of buffer

Path	csiph.com!news.redatomik.org!aioe.org!bofh.it!news.nic.it!robomod
From	Kees Cook <keescook@chromium.org>
Newsgroups	linux.kernel
Subject	[PATCH] ray_cs: Avoid reading past end of buffer
Date	Sat, 06 May 2017 00:40:01 +0200
Message-ID	<tDU3f-7VT-7@gated-at.bofh.it> (permalink)
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition; bh=hyfLTvNtqMt9r+E2io2qpyRPjdeuDK9aNhecU1D7Ylc=; b=dulYdz1CWZ6AaUtx14Oq6vCUm4q/JPdKxsaKmKAuOeH9+kAwd6doC/pNKSeCNanA4D 8gz+BZS5ZQ1X++xHDwpRRLNqPN5XEtKb2m2sj52eTexvWU4o0vPZgK5ZffSDjBX3xrpT zevfoIa+yB5qjcOQz3Rl5V1Rxsaf+xFgOI5uk=
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=hyfLTvNtqMt9r+E2io2qpyRPjdeuDK9aNhecU1D7Ylc=; b=iHt5QgrSJQ5GiKABDA769g2K6EfaSVIrjOJJDK6UvCCxZBRwSJ8wfFWt0ZkVNhdD8D 6rDxVhvKKbaJKuyZqNoI/e/hHDB/2rZMBaS3SojHLi8UGO3gMbX6jelRtZn9ouS4XTf5 FijDpg0liUxrPMlS/O4GXAz8p8uXC1GYDDKyYXZ8UaMMmv8rwHbq8JfkkUh6qaegNEvQ UNv3YKGq5lh6kHm1WmQdNyvgTjslL8z7wpF7BZskpOEFUygFNLxMP9nrQybj0ZTqxC34 pHFs+j/4MjLgafBK0NneZaMVpiT4CE8vpGzi8s32HeDYT3S3fdb8H2oG1oaRc01ZJ8Qa Wabg==
X-Gm-Message-State	AN3rC/59Rsi+50lIFCegZFfaIhGWHj2xWB/oRaZySi9R/sx1k8l+PAQN n+KHcl+T3ao5RyLo
X-Received	by 10.99.143.69 with SMTP id r5mr5959790pgn.77.1494023922908; Fri, 05 May 2017 15:38:42 -0700 (PDT)
MIME-Version	1.0
Content-Type	text/plain; charset=us-ascii
Content-Disposition	inline
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	45
Organization	linux.* mail to news gateway
X-Original-Cc	Kalle Valo <kvalo@codeaurora.org>, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Daniel Micay <danielmicay@gmail.com>
X-Original-Date	Fri, 5 May 2017 15:38:41 -0700
X-Original-Message-ID	<20170505223841.GA20367@beast>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1636773

Show key headers only | View raw

Using memcpy() from a buffer that is shorter than the length copied means
the destination buffer is being filled with arbitrary data from the kernel
rodata segment. In this case, the source was made longer, since it did not
match the destination structure size. Additionally removes a needless cast.

This was found with the future CONFIG_FORTIFY_SOURCE feature.

Cc: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
 drivers/net/wireless/ray_cs.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index b94479441b0c..170cd504e8ff 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -247,7 +247,10 @@ static const UCHAR b4_default_startup_parms[] = {
 	0x04, 0x08,		/* Noise gain, limit offset */
 	0x28, 0x28,		/* det rssi, med busy offsets */
 	7,			/* det sync thresh */
-	0, 2, 2			/* test mode, min, max */
+	0, 2, 2,		/* test mode, min, max */
+	0,			/* rx/tx delay */
+	0, 0, 0, 0, 0, 0,	/* current BSS id */
+	0			/* hop set */
 };
 
 /*===========================================================================*/
@@ -597,7 +600,7 @@ static void init_startup_params(ray_dev_t *local)
 	 *    a_beacon_period = hops    a_beacon_period = KuS
 	 *//* 64ms = 010000 */
 	if (local->fw_ver == 0x55) {
-		memcpy((UCHAR *) &local->sparm.b4, b4_default_startup_parms,
+		memcpy(&local->sparm.b4, b4_default_startup_parms,
 		       sizeof(struct b4_startup_params));
 		/* Translate sane kus input values to old build 4/5 format */
 		/* i = hop time in uS truncated to 3 bytes */
-- 
2.7.4


-- 
Kees Cook
Pixel Security

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH] ray_cs: Avoid reading past end of buffer Kees Cook <keescook@chromium.org> - 2017-05-06 00:40 +0200

csiph-web