From 3879e152ce7f7813eec30c10318ecd5f55dafee9 Mon Sep 17 00:00:00 2001 From: Weiguo Hu Date: Tue, 17 Nov 2020 14:29:34 +0800 Subject: [PATCH] net: wireless: rockchip_wlan: realtek wifi: fix buffer overflow issue in rtw_ioctl_wext_private References: CNVD-C-2020-263891 Signed-off-by: Weiguo Hu Change-Id: If80c197d9e806a04a14a3a8dbe195942deed46eb --- .../rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c | 4 ++-- .../rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c | 4 ++-- .../rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c | 4 ++-- .../rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_linux.c | 4 ++-- .../rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_linux.c | 4 ++-- .../rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c | 4 ++-- .../rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c | 4 ++-- .../rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_linux.c | 4 ++-- .../rockchip_wlan/rtl8821cs/os_dep/linux/ioctl_linux.c | 4 ++-- .../rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c | 4 ++-- .../rockchip_wlan/rtl8822bs/os_dep/linux/ioctl_linux.c | 4 ++-- 11 files changed, 22 insertions(+), 22 deletions(-) diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c index 5537ead019c2..c7faa24fbd85 100644 --- a/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c @@ -13095,7 +13095,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; @@ -13114,7 +13114,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32 *)buffer)[count++] = (s32)temp; diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c index fa829ba161f5..007062a7735e 100644 --- a/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c @@ -13705,7 +13705,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) break; + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; } while (1); @@ -13723,7 +13723,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) break; + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32*)buffer)[count++] = (s32)temp; } while (1); diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c index b260fab148ea..9f0e1723f049 100644 --- a/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c @@ -13660,7 +13660,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) break; + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; } while (1); @@ -13678,7 +13678,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) break; + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32*)buffer)[count++] = (s32)temp; } while (1); diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_linux.c index 0004933256a5..65a8bb28de29 100644 --- a/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_linux.c @@ -12598,7 +12598,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; @@ -12617,7 +12617,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32 *)buffer)[count++] = (s32)temp; diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_linux.c index 0b733e060048..26b3c658ef08 100644 --- a/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_linux.c @@ -12792,7 +12792,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; @@ -12811,7 +12811,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32 *)buffer)[count++] = (s32)temp; diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c index 22bb5c2439b8..55347bb3e399 100755 --- a/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c @@ -13586,7 +13586,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) break; + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; } while (1); @@ -13604,7 +13604,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) break; + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32*)buffer)[count++] = (s32)temp; } while (1); diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c index afce78422aa8..09ea7e8a4c27 100644 --- a/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c @@ -12751,7 +12751,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; @@ -12770,7 +12770,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32 *)buffer)[count++] = (s32)temp; diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_linux.c index ff4e51410442..191126f1cf74 100644 --- a/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_linux.c @@ -12625,7 +12625,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; @@ -12644,7 +12644,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32 *)buffer)[count++] = (s32)temp; diff --git a/drivers/net/wireless/rockchip_wlan/rtl8821cs/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8821cs/os_dep/linux/ioctl_linux.c index 11fea0692cbe..bc7fa6eb52f8 100644 --- a/drivers/net/wireless/rockchip_wlan/rtl8821cs/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8821cs/os_dep/linux/ioctl_linux.c @@ -12613,7 +12613,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; @@ -12632,7 +12632,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32 *)buffer)[count++] = (s32)temp; diff --git a/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c index be44a62c438b..d57baaeca666 100644 --- a/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c @@ -12930,7 +12930,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; @@ -12949,7 +12949,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32 *)buffer)[count++] = (s32)temp; diff --git a/drivers/net/wireless/rockchip_wlan/rtl8822bs/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8822bs/os_dep/linux/ioctl_linux.c index 91c07ae8d2c6..7c8c7b45cdaa 100644 --- a/drivers/net/wireless/rockchip_wlan/rtl8822bs/os_dep/linux/ioctl_linux.c +++ b/drivers/net/wireless/rockchip_wlan/rtl8822bs/os_dep/linux/ioctl_linux.c @@ -12589,7 +12589,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 4096) break; sscanf(str, "%i", &temp); buffer[count++] = (u8)temp; @@ -12608,7 +12608,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq count = 0; do { str = strsep(&ptr, delim); - if (NULL == str) + if (NULL == str || count >= 1024) break; sscanf(str, "%i", &temp); ((s32 *)buffer)[count++] = (s32)temp;