4.14-stable patches

added patches:
	staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch

diff --git a/queue-4.14/series b/queue-4.14/series
index b67839397821188ccb59741306e7821e0c25c77c..a3dddf37ed8cab2e99c4fefc14cebb707c5cd095 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -1 +1,2 @@
 x86-pci-xen-disable-pci-msi-masking-for-xen_hvm-guests.patch
+staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch

diff --git a/queue-4.14/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch b/queue-4.14/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch
new file mode 100644 (file)
index 0000000..d5a635c
--- /dev/null
+++ b/queue-4.14/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch
@@ -0,0 +1,37 @@
+From efremov@linux.com  Thu May 26 14:03:14 2022
+From: "Denis Efremov (Oracle)" <efremov@linux.com>
+Date: Mon, 23 May 2022 21:39:43 +0400
+Subject: staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
+To: gregkh@linuxfoundation.org
+Cc: "Denis Efremov (Oracle)" <efremov@linux.com>, Larry.Finger@lwfinger.net, phil@philpotter.co.uk, dan.carpenter@oracle.com, straube.linux@gmail.com, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, stable <stable@vger.kernel.org>
+Message-ID: <20220523173943.12486-1-efremov@linux.com>
+
+From: "Denis Efremov (Oracle)" <efremov@linux.com>
+
+This code has a check to prevent read overflow but it needs another
+check to prevent writing beyond the end of the ->Ssid[] array.
+
+Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_linux.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+@@ -1438,9 +1438,11 @@ static int rtw_wx_set_scan(struct net_de
+ 
+                                       sec_len = *(pos++); len-= 1;
+ 
+-                                      if (sec_len>0 && sec_len<=len) {
++                                      if (sec_len > 0 &&
++                                          sec_len <= len &&
++                                          sec_len <= 32) {
+                                               ssid[ssid_index].SsidLength = sec_len;
+-                                              memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
++                                              memcpy(ssid[ssid_index].Ssid, pos, sec_len);
+                                               /* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */
+                                               /*      , ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */
+                                               ssid_index++;