From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932164AbdEJXFP (ORCPT ); Wed, 10 May 2017 19:05:15 -0400 Received: from smtprelay0065.hostedemail.com ([216.40.44.65]:38421 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932125AbdEJXFN (ORCPT ); Wed, 10 May 2017 19:05:13 -0400 X-Session-Marker: 6A6F6540706572636865732E636F6D X-Spam-Summary: 2,0,0,,d41d8cd98f00b204,joe@perches.com,:::::::::::::,RULES_HIT:41:355:379:541:599:960:973:988:989:1260:1277:1311:1313:1314:1345:1359:1373:1437:1515:1516:1518:1534:1541:1593:1594:1711:1730:1747:1777:1792:2393:2553:2559:2562:2689:2828:3138:3139:3140:3141:3142:3352:3622:3653:3865:3866:3867:3868:3871:3874:4321:5007:7903:10004:10400:10848:11026:11232:11473:11657:11658:11914:12043:12049:12296:12438:12679:12740:12760:12895:13069:13311:13357:13439:14659:14721:21080:21627:30034:30054:30079:30090:30091,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:2,LUA_SUMMARY:none X-HE-Tag: basin19_4a175c3eab223 X-Filterd-Recvd-Size: 2089 Message-ID: <1494457506.2028.1.camel@perches.com> Subject: Re: [PATCH] libertas: Avoid reading past end of buffer From: Joe Perches To: Kees Cook , netdev@vger.kernel.org Cc: Kalle Valo , libertas-dev@lists.infradead.org, linux-wireless@vger.kernel.org, Daniel Micay , linux-kernel@vger.kernel.org Date: Wed, 10 May 2017 16:05:06 -0700 In-Reply-To: <20170510192451.GA115771@beast> References: <20170510192451.GA115771@beast> Content-Type: text/plain; charset="ISO-8859-1" X-Mailer: Evolution 3.22.6-1ubuntu1 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 2017-05-10 at 12:24 -0700, Kees Cook wrote: > Using memcpy() from a string that is shorter than the length copied means [] > diff --git a/drivers/net/wireless/marvell/libertas/mesh.c b/drivers/net/wireless/marvell/libertas/mesh.c [] > @@ -1170,17 +1170,11 @@ int lbs_mesh_ethtool_get_sset_count(struct net_device *dev, int sset) > void lbs_mesh_ethtool_get_strings(struct net_device *dev, > uint32_t stringset, uint8_t *s) > { > - int i; > - > lbs_deb_enter(LBS_DEB_ETHTOOL); > > switch (stringset) { > case ETH_SS_STATS: > - for (i = 0; i < MESH_STATS_NUM; i++) { > - memcpy(s + i * ETH_GSTRING_LEN, > - mesh_stat_strings[i], > - ETH_GSTRING_LEN); > - } > + memcpy(s, *mesh_stat_strings, sizeof(mesh_stat_strings)); > break; > } > lbs_deb_enter(LBS_DEB_ETHTOOL); unrelated trivia: lbs_deb_enter is used incorrectly here at function exit as both enter and leave calls. That type of copy/paste defect may be common. $ git grep -w lbs_deb_enter | wc -l 148 $ git grep -w lbs_deb_leave | wc -l 71 One would expect these numbers to be the same. Another option would be to delete all these calls as ftrace function tracing works well.