Re: [PATCH] libertas: Avoid reading past end of buffer

2017-05-10 Thread Kalle Valo
Joe Perches writes: > unrelated trivia: > > lbs_deb_enter is used incorrectly here at > function exit as both enter and leave calls. > > That type of copy/paste defect may be common. > > $ git grep -w lbs_deb_enter | wc -l > 148 > $ git grep -w lbs_deb_leave | wc -l > 71 > > One would expect thes

Re: [PATCH] libertas: Avoid reading past end of buffer

2017-05-10 Thread Joe Perches
On Wed, 2017-05-10 at 12:24 -0700, Kees Cook wrote: > Using memcpy() from a string that is shorter than the length copied means > the destination buffer is being filled with arbitrary data from the kernel > rodata segment. another bit of trivia: > diff --git a/drivers/net/wireless/marvell/libert

Re: [PATCH] libertas: Avoid reading past end of buffer

2017-05-10 Thread Joe Perches
On Wed, 2017-05-10 at 12:24 -0700, Kees Cook wrote: > Using memcpy() from a string that is shorter than the length copied means [] > diff --git a/drivers/net/wireless/marvell/libertas/mesh.c > b/drivers/net/wireless/marvell/libertas/mesh.c [] > @@ -1170,17 +1170,11 @@ int lbs_mesh_ethtool_get_sset

[PATCH] libertas: Avoid reading past end of buffer

2017-05-10 Thread Kees Cook
Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, redefine the stat strings to be ETH_GSTRING_LEN sizes, like other drivers. This lets us use a single memcpy that does not lea

Re: [PATCH] libertas: Avoid reading past end of buffer

2017-05-10 Thread Kees Cook
On Tue, May 9, 2017 at 9:33 PM, Joe Perches wrote: > On Tue, 2017-05-09 at 16:23 -0700, Kees Cook wrote: >> Using memcpy() from a string that is shorter than the length copied means >> the destination buffer is being filled with arbitrary data from the kernel >> rodata segment. Instead, use strncp

Re: [PATCH] libertas: Avoid reading past end of buffer

2017-05-09 Thread Joe Perches
On Tue, 2017-05-09 at 16:23 -0700, Kees Cook wrote: > Using memcpy() from a string that is shorter than the length copied means > the destination buffer is being filled with arbitrary data from the kernel > rodata segment. Instead, use strncpy() which will fill the trailing bytes > with zeros. Addi

[PATCH] libertas: Avoid reading past end of buffer

2017-05-09 Thread Kees Cook
Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, use strncpy() which will fill the trailing bytes with zeros. Additionally adjust indentation to keep checkpatch.pl happy. Th