From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752707AbaBLI0J (ORCPT ); Wed, 12 Feb 2014 03:26:09 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:50226 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752101AbaBLIOF (ORCPT ); Wed, 12 Feb 2014 03:14:05 -0500 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Evan Huus" , "Johannes Berg" Date: Wed, 12 Feb 2014 08:10:12 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.2 42/79] radiotap: fix bitmap-end-finding buffer overrun In-Reply-To: X-SA-Exim-Connect-IP: 91.84.160.45 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.2.55-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Johannes Berg commit bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 upstream. Evan Huus found (by fuzzing in wireshark) that the radiotap iterator code can access beyond the length of the buffer if the first bitmap claims an extension but then there's no data at all. Fix this. Reported-by: Evan Huus Signed-off-by: Johannes Berg Signed-off-by: Ben Hutchings --- net/wireless/radiotap.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/net/wireless/radiotap.c +++ b/net/wireless/radiotap.c @@ -122,6 +122,10 @@ int ieee80211_radiotap_iterator_init( /* find payload start allowing for extended bitmap(s) */ if (iterator->_bitmap_shifter & (1<_arg - + (unsigned long)iterator->_rtheader + sizeof(uint32_t) > + (unsigned long)iterator->_max_length) + return -EINVAL; while (get_unaligned_le32(iterator->_arg) & (1 << IEEE80211_RADIOTAP_EXT)) { iterator->_arg += sizeof(uint32_t);