From: Greg Kroah-Hartman Date: Thu, 26 May 2022 12:05:57 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.18.1~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5929291a9afa3f0cd3376ff10dbad8ea1075768c;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch --- diff --git a/queue-5.10/series b/queue-5.10/series index 171495bc682..b7d157746fb 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1 +1,2 @@ lockdown-also-lock-down-previous-kgdb-use.patch +staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch diff --git a/queue-5.10/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch b/queue-5.10/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch new file mode 100644 index 00000000000..e56e9567195 --- /dev/null +++ b/queue-5.10/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch @@ -0,0 +1,37 @@ +From efremov@linux.com Thu May 26 14:03:56 2022 +From: "Denis Efremov (Oracle)" +Date: Fri, 20 May 2022 07:57:30 +0400 +Subject: staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan() +To: gregkh@linuxfoundation.org +Cc: "Denis Efremov (Oracle)" , Larry.Finger@lwfinger.net, phil@philpotter.co.uk, dan.carpenter@oracle.com, straube.linux@gmail.com, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, stable +Message-ID: <20220520035730.5533-1-efremov@linux.com> + +From: "Denis Efremov (Oracle)" + +This code has a check to prevent read overflow but it needs another +check to prevent writing beyond the end of the ->Ssid[] array. + +Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") +Cc: stable +Signed-off-by: Denis Efremov (Oracle) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c ++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +@@ -1351,9 +1351,11 @@ static int rtw_wx_set_scan(struct net_de + + sec_len = *(pos++); len -= 1; + +- if (sec_len > 0 && sec_len <= len) { ++ if (sec_len > 0 && ++ sec_len <= len && ++ sec_len <= 32) { + ssid[ssid_index].SsidLength = sec_len; +- memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength); ++ memcpy(ssid[ssid_index].Ssid, pos, sec_len); + /* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */ + /* , ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */ + ssid_index++;