Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME

I repeatedly get __stack_chk_fail panic()s with this driver before
applying the attached fix.

ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.

length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17

This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.

It can be applied to 2.6.30-stable as well.

Signed-off-by: Dan Aloni <dan@aloni.org>
Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

authored by Dan Aloni and committed by Greg Kroah-Hartman 02c8baec 77b92881

+6 -6
+6 -6
drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
··· 461 461 struct iw_request_info *info, 462 462 union iwreq_data *wrqu, char *extra) 463 463 { 464 - strcpy(wrqu->name, "802.11"); 464 + strlcpy(wrqu->name, "802.11", IFNAMSIZ); 465 465 if(ieee->modulation & IEEE80211_CCK_MODULATION){ 466 - strcat(wrqu->name, "b"); 466 + strlcat(wrqu->name, "b", IFNAMSIZ); 467 467 if(ieee->modulation & IEEE80211_OFDM_MODULATION) 468 - strcat(wrqu->name, "/g"); 468 + strlcat(wrqu->name, "/g", IFNAMSIZ); 469 469 }else if(ieee->modulation & IEEE80211_OFDM_MODULATION) 470 - strcat(wrqu->name, "g"); 470 + strlcat(wrqu->name, "g", IFNAMSIZ); 471 471 472 472 if((ieee->state == IEEE80211_LINKED) || 473 473 (ieee->state == IEEE80211_LINKED_SCANNING)) 474 - strcat(wrqu->name," linked"); 474 + strlcat(wrqu->name," link", IFNAMSIZ); 475 475 else if(ieee->state != IEEE80211_NOLINK) 476 - strcat(wrqu->name," link.."); 476 + strlcat(wrqu->name," .....", IFNAMSIZ); 477 477 478 478 479 479 return 0;