5.10-stable patches

added patches:
	staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch

diff --git a/queue-5.10/series b/queue-5.10/series
index 171495bc6828c48d9e60855b49bf216621bf6308..b7d157746fb5f3c5d09c677d6d4bf216b7e49aeb 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -1 +1,2 @@
 lockdown-also-lock-down-previous-kgdb-use.patch
+staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch

diff --git a/queue-5.10/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch b/queue-5.10/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch
new file mode 100644 (file)
index 0000000..e56e956
--- /dev/null
+++ b/queue-5.10/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch
@@ -0,0 +1,37 @@
+From efremov@linux.com  Thu May 26 14:03:56 2022
+From: "Denis Efremov (Oracle)" <efremov@linux.com>
+Date: Fri, 20 May 2022 07:57:30 +0400
+Subject: staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
+To: gregkh@linuxfoundation.org
+Cc: "Denis Efremov (Oracle)" <efremov@linux.com>, Larry.Finger@lwfinger.net, phil@philpotter.co.uk, dan.carpenter@oracle.com, straube.linux@gmail.com, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, stable <stable@vger.kernel.org>
+Message-ID: <20220520035730.5533-1-efremov@linux.com>
+
+From: "Denis Efremov (Oracle)" <efremov@linux.com>
+
+This code has a check to prevent read overflow but it needs another
+check to prevent writing beyond the end of the ->Ssid[] array.
+
+Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_linux.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+@@ -1351,9 +1351,11 @@ static int rtw_wx_set_scan(struct net_de
+ 
+                                       sec_len = *(pos++); len -= 1;
+ 
+-                                      if (sec_len > 0 && sec_len <= len) {
++                                      if (sec_len > 0 &&
++                                          sec_len <= len &&
++                                          sec_len <= 32) {
+                                               ssid[ssid_index].SsidLength = sec_len;
+-                                              memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
++                                              memcpy(ssid[ssid_index].Ssid, pos, sec_len);
+                                               /* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */
+                                               /*      , ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */
+                                               ssid_index++;