BACKPORT: cfg80211: wext: avoid copying malformed SSIDs
Ensure the SSID element is bounds-checked prior to invoking memcpy()
with its length field, when copying to userspace.
BUG=chromium:1031112
TEST=None
Cc: <stable@vger.kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Reported-by: Nicolas Waisman <nico@semmle.com>
Signed-off-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20191004095132.15777-2-will@kernel.org
[adjust commit log a bit]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[backport: Apply patch to 3.8/4.2 wireless directories]
(cherry picked from commit 4ac2813cc867ae563a1ba5a9414bfb554e5796fa)
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Change-Id: I25fc6d81d1480af0eb2b7536b2ecf5021f1683f9
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1972291
Reviewed-by: Brian Norris <briannorris@chromium.org>
Commit-Queue: Brian Norris <briannorris@chromium.org>
Tested-by: Brian Norris <briannorris@chromium.org>
Auto-Submit: Guenter Roeck <groeck@chromium.org>
2 files changed
