linux-kernel - [PATCH] staging: wilc1000: off by one in wilc_wfi_cfg80211_mgmt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1432825436-9800-1-git-send-email-sasha.levin@oracle.com>
Date:	Thu, 28 May 2015 11:03:56 -0400
From:	Sasha Levin <sasha.levin@...cle.com>
To:	johnny.kim@...el.com, rachel.kim@...el.com, dean.lee@...el.com,
	chris.park@...el.com, nicolas.ferre@...el.com
Cc:	gregkh@...uxfoundation.org, devel@...verdev.osuosl.org,
	linux-kernel@...r.kernel.org, Sasha Levin <sasha.levin@...cle.com>
Subject: [PATCH] staging: wilc1000: off by one in wilc_wfi_cfg80211_mgmt_types

NL80211_IFTYPE_MAX represents the largest interface type number defined,
so declaring the array with that size will actually leave out the last
interface.

This causes invalid memory access whenever this array is used, which starts
happening at boot.

Signed-off-by: Sasha Levin <sasha.levin@...cle.com>
---
 drivers/staging/wilc1000/wilc_wfi_cfgoperations.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.h b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.h
index 9eb8f37..3a63fbd 100644
--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.h
+++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.h
@@ -82,7 +82,7 @@ static const u32 cipher_suites[] = {
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
 static const struct ieee80211_txrx_stypes
-	wilc_wfi_cfg80211_mgmt_types[NL80211_IFTYPE_MAX] = {
+	wilc_wfi_cfg80211_mgmt_types[NUM_NL80211_IFTYPES] = {
 	[NL80211_IFTYPE_STATION] = {
 		.tx = 0xffff,
 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/