From: Greg Kroah-Hartman Date: Thu, 26 May 2022 12:05:26 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.18.1~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=115ef8822639af01b08479406c2cebce1143ff32;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch --- diff --git a/queue-4.14/series b/queue-4.14/series index b6783939782..a3dddf37ed8 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -1 +1,2 @@ x86-pci-xen-disable-pci-msi-masking-for-xen_hvm-guests.patch +staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch diff --git a/queue-4.14/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch b/queue-4.14/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch new file mode 100644 index 00000000000..d5a635c8a26 --- /dev/null +++ b/queue-4.14/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch @@ -0,0 +1,37 @@ +From efremov@linux.com Thu May 26 14:03:14 2022 +From: "Denis Efremov (Oracle)" +Date: Mon, 23 May 2022 21:39:43 +0400 +Subject: staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan() +To: gregkh@linuxfoundation.org +Cc: "Denis Efremov (Oracle)" , Larry.Finger@lwfinger.net, phil@philpotter.co.uk, dan.carpenter@oracle.com, straube.linux@gmail.com, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, stable +Message-ID: <20220523173943.12486-1-efremov@linux.com> + +From: "Denis Efremov (Oracle)" + +This code has a check to prevent read overflow but it needs another +check to prevent writing beyond the end of the ->Ssid[] array. + +Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") +Cc: stable +Signed-off-by: Denis Efremov (Oracle) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c ++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +@@ -1438,9 +1438,11 @@ static int rtw_wx_set_scan(struct net_de + + sec_len = *(pos++); len-= 1; + +- if (sec_len>0 && sec_len<=len) { ++ if (sec_len > 0 && ++ sec_len <= len && ++ sec_len <= 32) { + ssid[ssid_index].SsidLength = sec_len; +- memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength); ++ memcpy(ssid[ssid_index].Ssid, pos, sec_len); + /* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */ + /* , ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */ + ssid_index++;