Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

wl3501_cs: min_t() cast truncates high bits

wrqu->encoding.length comes from the network administrator. It's
size u16. We want to limit "tocopy" to the smallest value of either
"len_keys", "wrqu->encoding.length" or 100. But because .length
gets cast from u16 to u8 we might use a random, smaller value than
the was desired. It's probably not very serious, but we may as well
fix it.

Btw, this is from code auditing and not from testing. I don't know
if this affects anyone in real life.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

authored by

Dan Carpenter and committed by
John W. Linville
2fb40577 f6f3def3

+1 -1
+1 -1
drivers/net/wireless/wl3501_cs.c
··· 1781 1781 keys, len_keys); 1782 1782 if (rc) 1783 1783 goto out; 1784 - tocopy = min_t(u8, len_keys, wrqu->encoding.length); 1784 + tocopy = min_t(u16, len_keys, wrqu->encoding.length); 1785 1785 tocopy = min_t(u8, tocopy, 100); 1786 1786 wrqu->encoding.length = tocopy; 1787 1787 memcpy(extra, keys, tocopy);