Skip to content

Commit fcd2042

Browse files
computersforpeaceKalle Valo
authored andcommitted
mwifiex: printk() overflow with 32-byte SSIDs
SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length when we print them out. This can be easily noticed by connecting to a network with a 32-octet SSID: [ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to '0123456789abcdef0123456789abcdef <uninitialized mem>' bssid xx:xx:xx:xx:xx:xx Fixes: 5e6e3a9 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Brian Norris <briannorris@chromium.org> Cc: <stable@vger.kernel.org> Acked-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
1 parent d3532ea commit fcd2042

1 file changed

Lines changed: 7 additions & 6 deletions

File tree

drivers/net/wireless/marvell/mwifiex/cfg80211.c

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2222,8 +2222,9 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len,
22222222
is_scanning_required = 1;
22232223
} else {
22242224
mwifiex_dbg(priv->adapter, MSG,
2225-
"info: trying to associate to '%s' bssid %pM\n",
2226-
(char *)req_ssid.ssid, bss->bssid);
2225+
"info: trying to associate to '%.*s' bssid %pM\n",
2226+
req_ssid.ssid_len, (char *)req_ssid.ssid,
2227+
bss->bssid);
22272228
memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN);
22282229
break;
22292230
}
@@ -2283,8 +2284,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
22832284
}
22842285

22852286
mwifiex_dbg(adapter, INFO,
2286-
"info: Trying to associate to %s and bssid %pM\n",
2287-
(char *)sme->ssid, sme->bssid);
2287+
"info: Trying to associate to %.*s and bssid %pM\n",
2288+
(int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
22882289

22892290
if (!mwifiex_stop_bg_scan(priv))
22902291
cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
@@ -2417,8 +2418,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
24172418
}
24182419

24192420
mwifiex_dbg(priv->adapter, MSG,
2420-
"info: trying to join to %s and bssid %pM\n",
2421-
(char *)params->ssid, params->bssid);
2421+
"info: trying to join to %.*s and bssid %pM\n",
2422+
params->ssid_len, (char *)params->ssid, params->bssid);
24222423

24232424
mwifiex_set_ibss_params(priv, params);
24242425

0 commit comments

Comments
 (0)