staging: wlan-ng: Disable buggy MIB ioctl

struct hfa384x_wpa_data ends with a flexible array, but it is allocated
on the stack. This means it can never hold any data. Disable the
memcpy() calls in and out of the structure, since it must always be
zero. This could never have worked.

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Cc: linux-staging@lists.linux.dev
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210818081937.1668775-1-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/wlan-ng/prism2mib.c b/drivers/staging/wlan-ng/prism2mib.c
index 875812a391c97af52c8c9294d7081e8d86367c16..d14f032a7ed662d6db33010e325b07c48d75e7dd 100644 (file)
--- a/drivers/staging/wlan-ng/prism2mib.c
+++ b/drivers/staging/wlan-ng/prism2mib.c
@@ -668,6 +668,10 @@ static int prism2mib_priv(struct mibrec *mib,
 
        switch (mib->did) {
        case DIDMIB_LNX_CONFIGTABLE_RSNAIE: {
+               /*
+                * This can never work: wpa is on the stack
+                * and has no bytes allocated in wpa.data.
+                */
                struct hfa384x_wpa_data wpa;
 
                if (isget) {
@@ -675,11 +679,17 @@ static int prism2mib_priv(struct mibrec *mib,
                                               HFA384x_RID_CNFWPADATA,
                                               (u8 *)&wpa,
                                               sizeof(wpa));
+                       /*
                        pstr->len = le16_to_cpu(wpa.datalen);
                        memcpy(pstr->data, wpa.data, pstr->len);
+                       */
+                       pstr->len = 0;
                } else {
+                       /*
                        wpa.datalen = cpu_to_le16(pstr->len);
                        memcpy(wpa.data, pstr->data, pstr->len);
+                       */
+                       wpa.datalen = 0;
 
                        hfa384x_drvr_setconfig(hw,
                                               HFA384x_RID_CNFWPADATA,