tree 833a37222404f0f74512302bf7d1f2201ff64773
parent 05c43bbe912fb0341f9e989f711d8651b6fa7fad
author Will Deacon <will@kernel.org> 1570182692 +0100
committer Commit Bot <commit-bot@chromium.org> 1576620430 +0000

BACKPORT: cfg80211: wext: avoid copying malformed SSIDs

Ensure the SSID element is bounds-checked prior to invoking memcpy()
with its length field, when copying to userspace.

BUG=chromium:1031112
TEST=None

Cc: <stable@vger.kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Reported-by: Nicolas Waisman <nico@semmle.com>
Signed-off-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20191004095132.15777-2-will@kernel.org
[adjust commit log a bit]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[backport: Apply patch to 3.8/4.2 wireless directories]
(cherry picked from commit 4ac2813cc867ae563a1ba5a9414bfb554e5796fa)
Signed-off-by: Guenter Roeck <groeck@chromium.org>

Change-Id: I25fc6d81d1480af0eb2b7536b2ecf5021f1683f9
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1972291
Reviewed-by: Brian Norris <briannorris@chromium.org>
Commit-Queue: Brian Norris <briannorris@chromium.org>
Tested-by: Brian Norris <briannorris@chromium.org>
Auto-Submit: Guenter Roeck <groeck@chromium.org>