Re: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs

[Brian Norris]

On Thu, Nov 10, 2016 at 12:20:53AM +0200, Kalle Valo wrote:
> Brian Norris  writes:
> 
> > SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
> > when we print them out.
> >
> > This can be easily noticed by connecting to a network with a 32-octet
> > SSID:
> >
> > [ 3903.502925] mwifiex_pcie :01:00.0: info: trying to associate to
> > '0123456789abcdef0123456789abcdef ' bssid
> > xx:xx:xx:xx:xx:xx
> >
> > Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex 
> > driver")
> > Signed-off-by: Brian Norris 
> > Cc: 
> 
> I'm planning to push this to 4.9 if no objections.

SGTM. Thanks.

Re: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs

[Brian Norris]

On Thu, Nov 10, 2016 at 12:20:53AM +0200, Kalle Valo wrote:
> Brian Norris  writes:
> 
> > SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
> > when we print them out.
> >
> > This can be easily noticed by connecting to a network with a 32-octet
> > SSID:
> >
> > [ 3903.502925] mwifiex_pcie :01:00.0: info: trying to associate to
> > '0123456789abcdef0123456789abcdef ' bssid
> > xx:xx:xx:xx:xx:xx
> >
> > Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex 
> > driver")
> > Signed-off-by: Brian Norris 
> > Cc: 
> 
> I'm planning to push this to 4.9 if no objections.

SGTM. Thanks.

Re: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs

[Kalle Valo]

Brian Norris  writes:

> SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
> when we print them out.
>
> This can be easily noticed by connecting to a network with a 32-octet
> SSID:
>
> [ 3903.502925] mwifiex_pcie :01:00.0: info: trying to associate to
> '0123456789abcdef0123456789abcdef ' bssid
> xx:xx:xx:xx:xx:xx
>
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex 
> driver")
> Signed-off-by: Brian Norris 
> Cc: 

I'm planning to push this to 4.9 if no objections.

-- 
Kalle Valo

Re: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs

[Kalle Valo]

Brian Norris  writes:

> SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
> when we print them out.
>
> This can be easily noticed by connecting to a network with a 32-octet
> SSID:
>
> [ 3903.502925] mwifiex_pcie :01:00.0: info: trying to associate to
> '0123456789abcdef0123456789abcdef ' bssid
> xx:xx:xx:xx:xx:xx
>
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex 
> driver")
> Signed-off-by: Brian Norris 
> Cc: 

I'm planning to push this to 4.9 if no objections.

-- 
Kalle Valo

RE: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs

[Amitkumar Karwar]

> From: Brian Norris [mailto:briannor...@chromium.org]
> Sent: Wednesday, November 09, 2016 7:58 AM
> To: Amitkumar Karwar; Nishant Sarmukadam; Kalle Valo
> Cc: linux-kernel@vger.kernel.org; linux-wirel...@vger.kernel.org; Cathy
> Luo; secur...@kernel.org; sta...@vger.kernel.org; Brian Norris
> Subject: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs
> 
> SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
> when we print them out.
> 
> This can be easily noticed by connecting to a network with a 32-octet
> SSID:
> 
> [ 3903.502925] mwifiex_pcie :01:00.0: info: trying to associate to
> '0123456789abcdef0123456789abcdef ' bssid
> xx:xx:xx:xx:xx:xx
> 
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell
> mwifiex driver")
> Signed-off-by: Brian Norris 
> Cc: 
> ---
>  drivers/net/wireless/marvell/mwifiex/cfg80211.c | 13 +++--
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> index 39ce76ad00bc..16241d21727b 100644
> --- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> +++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> @@ -,8 +,9 @@ mwifiex_cfg80211_assoc(struct mwifiex_private
> *priv, size_t ssid_len,
>   is_scanning_required = 1;
>   } else {
>   mwifiex_dbg(priv->adapter, MSG,
> - "info: trying to associate to '%s' bssid
> %pM\n",
> - (char *)req_ssid.ssid, bss->bssid);
> + "info: trying to associate to '%.*s' bssid
> %pM\n",
> + req_ssid.ssid_len, (char *)req_ssid.ssid,
> + bss->bssid);
>   memcpy(>cfg_bssid, bss->bssid, ETH_ALEN);
>   break;
>   }
> @@ -2283,8 +2284,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy,
> struct net_device *dev,
>   }
> 
>   mwifiex_dbg(adapter, INFO,
> - "info: Trying to associate to %s and bssid %pM\n",
> - (char *)sme->ssid, sme->bssid);
> + "info: Trying to associate to %.*s and bssid %pM\n",
> + (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
> 
>   if (!mwifiex_stop_bg_scan(priv))
>   cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
> @@ -2417,8 +2418,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy,
> struct net_device *dev,
>   }
> 
>   mwifiex_dbg(priv->adapter, MSG,
> - "info: trying to join to %s and bssid %pM\n",
> - (char *)params->ssid, params->bssid);
> + "info: trying to join to %.*s and bssid %pM\n",
> + params->ssid_len, (char *)params->ssid, params->bssid);
> 
>   mwifiex_set_ibss_params(priv, params);
> 
> --
> 2.8.0.rc3.226.g39d4020

Thanks for fixing this.

Acked-by: Amitkumar Karwar 

Regards,
Amitkumar

RE: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs

[Amitkumar Karwar]

> From: Brian Norris [mailto:briannor...@chromium.org]
> Sent: Wednesday, November 09, 2016 7:58 AM
> To: Amitkumar Karwar; Nishant Sarmukadam; Kalle Valo
> Cc: linux-kernel@vger.kernel.org; linux-wirel...@vger.kernel.org; Cathy
> Luo; secur...@kernel.org; sta...@vger.kernel.org; Brian Norris
> Subject: [PATCH] mwifiex: printk() overflow with 32-byte SSIDs
> 
> SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
> when we print them out.
> 
> This can be easily noticed by connecting to a network with a 32-octet
> SSID:
> 
> [ 3903.502925] mwifiex_pcie :01:00.0: info: trying to associate to
> '0123456789abcdef0123456789abcdef ' bssid
> xx:xx:xx:xx:xx:xx
> 
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell
> mwifiex driver")
> Signed-off-by: Brian Norris 
> Cc: 
> ---
>  drivers/net/wireless/marvell/mwifiex/cfg80211.c | 13 +++--
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> index 39ce76ad00bc..16241d21727b 100644
> --- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> +++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
> @@ -,8 +,9 @@ mwifiex_cfg80211_assoc(struct mwifiex_private
> *priv, size_t ssid_len,
>   is_scanning_required = 1;
>   } else {
>   mwifiex_dbg(priv->adapter, MSG,
> - "info: trying to associate to '%s' bssid
> %pM\n",
> - (char *)req_ssid.ssid, bss->bssid);
> + "info: trying to associate to '%.*s' bssid
> %pM\n",
> + req_ssid.ssid_len, (char *)req_ssid.ssid,
> + bss->bssid);
>   memcpy(>cfg_bssid, bss->bssid, ETH_ALEN);
>   break;
>   }
> @@ -2283,8 +2284,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy,
> struct net_device *dev,
>   }
> 
>   mwifiex_dbg(adapter, INFO,
> - "info: Trying to associate to %s and bssid %pM\n",
> - (char *)sme->ssid, sme->bssid);
> + "info: Trying to associate to %.*s and bssid %pM\n",
> + (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
> 
>   if (!mwifiex_stop_bg_scan(priv))
>   cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
> @@ -2417,8 +2418,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy,
> struct net_device *dev,
>   }
> 
>   mwifiex_dbg(priv->adapter, MSG,
> - "info: trying to join to %s and bssid %pM\n",
> - (char *)params->ssid, params->bssid);
> + "info: trying to join to %.*s and bssid %pM\n",
> + params->ssid_len, (char *)params->ssid, params->bssid);
> 
>   mwifiex_set_ibss_params(priv, params);
> 
> --
> 2.8.0.rc3.226.g39d4020

Thanks for fixing this.

Acked-by: Amitkumar Karwar 

Regards,
Amitkumar