Re: [PATCH AUTOSEL 4.19 14/60] mwifiex: Abort at too short BSS descriptor element

2019-07-10 Thread Brian Norris
On Wed, Jul 10, 2019 at 7:51 AM Sasha Levin wrote: > I see that 63d7ef36103d didn't make it into 5.2, so I'll just drop this > for now. Yeah, I think it's stuck at net/master. Presumably it'll get into 5.3-rc somewhere. Brian

Re: [PATCH AUTOSEL 4.19 14/60] mwifiex: Abort at too short BSS descriptor element

2019-07-10 Thread Sasha Levin
On Fri, Jun 28, 2019 at 03:58:49PM -0700, Brian Norris wrote: On Wed, Jun 26, 2019 at 5:49 PM Sasha Levin wrote: From: Takashi Iwai [ Upstream commit 685c9b7750bfacd6fc1db50d86579980593b7869 ] Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that the source descriptor entries

Re: [PATCH AUTOSEL 4.19 14/60] mwifiex: Abort at too short BSS descriptor element

2019-06-28 Thread Brian Norris
On Wed, Jun 26, 2019 at 5:49 PM Sasha Levin wrote: > > From: Takashi Iwai > > [ Upstream commit 685c9b7750bfacd6fc1db50d86579980593b7869 ] > > Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that > the source descriptor entries contain the enough size for each type > and performs c

[PATCH AUTOSEL 4.19 14/60] mwifiex: Abort at too short BSS descriptor element

2019-06-26 Thread Sasha Levin
From: Takashi Iwai [ Upstream commit 685c9b7750bfacd6fc1db50d86579980593b7869 ] Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that the source descriptor entries contain the enough size for each type and performs copying without checking the source size. This may lead to read ov