From: Johannes Berg Date: Thu, 27 Apr 2017 11:19:04 +0000 (+0200) Subject: mac80211: fix IBSS presp allocation size X-Git-Tag: archive/raspbian/4.9.30-2+deb9u2+rpi1~4^2~339 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=e25d4712f48bdaf5497acbc7dbb12cf9afca5fe9;p=linux-4.9.git mac80211: fix IBSS presp allocation size commit f1f3e9e2a50a70de908f9dfe0d870e9cdc67e042 upstream. When VHT IBSS support was added, the size of the extra elements wasn't considered in ieee80211_ibss_build_presp(), which makes it possible that it would overrun the allocated buffer. Fix it by allocating the necessary space. Fixes: abcff6ef01f9 ("mac80211: add VHT support for IBSS") Reported-by: Shaul Triebitz Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c index 98999d3d5262..62d13eabe17f 100644 --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -66,6 +66,8 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata, 2 + (IEEE80211_MAX_SUPP_RATES - 8) + 2 + sizeof(struct ieee80211_ht_cap) + 2 + sizeof(struct ieee80211_ht_operation) + + 2 + sizeof(struct ieee80211_vht_cap) + + 2 + sizeof(struct ieee80211_vht_operation) + ifibss->ie_len; presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL); if (!presp)