[PATCH 2/2] libertas: make lbs_ibss_join_existing() return error code on rates overflow
From: Nicolai Stange <hidden>
Date: 2020-01-14 10:39:56
Also in:
linux-wireless, lkml
Subsystem:
marvell libertas wireless driver, the rest · Maintainer:
Linus Torvalds
Possibly related (same subject, not in this thread)
- 2020-01-14 · Re: [PATCH 2/2] libertas: make lbs_ibss_join_existing() return error code on rates overflow · Kalle Valo <hidden>
Commit e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss
descriptor") introduced a bounds check on the number of supplied rates to
lbs_ibss_join_existing() and made it to return on overflow.
However, the aforementioned commit doesn't set the return value accordingly
and thus, lbs_ibss_join_existing() would return with zero even though it
failed.
Make lbs_ibss_join_existing return -EINVAL in case the bounds check on the
number of supplied rates fails.
Fixes: e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss
descriptor")
Signed-off-by: Nicolai Stange <redacted>
---
drivers/net/wireless/marvell/libertas/cfg.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c
index 68985d766349..4e3de684928b 100644
--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++ b/drivers/net/wireless/marvell/libertas/cfg.c@@ -1786,6 +1786,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv, if (rates_max > MAX_RATES) { lbs_deb_join("invalid rates"); rcu_read_unlock(); + ret = -EINVAL; goto out; } rates = cmd.bss.rates;
--
2.16.4