commit 4da7ec9b08ccf17646fdc690f3f1fdc9957d68da
author Sushant Kaushik <skaushik@qti.qualcomm.com> Wed Jul 15 16:39:32 2015 +0530
committer Satyanarayana Dash <sadash@codeaurora.org> Wed Jul 15 19:52:49 2015 +0530
tree 8dad27fcfb2e4c2e25268ece295666358af123d9
parent f8abd3563ee045dd27c09eeee96bbc22de448f26

wlan: Fix buffer overwrite problem in GETFASTROAM

If (len + 1) is greater than priv_data.total_len then copy_to_user
results in writing more data than the buffer can hold.
Fix this by writing mininum of (len + 1) and priv_data.total_len.

Change-Id: Ic52094eb93e01fd1dd653645127632677d31f7dc
CRs-Fixed: 865571

CORE/HDD/src/wlan_hdd_main.c

diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index eca9d6c..7e2075a 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -2897,7 +2897,8 @@
 
            len = scnprintf(extra, sizeof(extra), "%s %d",
                    "GETFASTROAM", lfrMode);
-           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           len = VOS_MIN(priv_data.total_len, len + 1);
+           if (copy_to_user(priv_data.buf, &extra, len))
            {
                VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "%s: failed to copy data to user buffer", __func__);