FAILED: patch "[PATCH] staging: rtl8723bs: fix heap buffer overflow in" failed to apply to 5.15-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 5a752a616e756844388a1a45404db9fc29fec655
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026071335-spindle-refutable-39c3@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 5a752a616e756844388a1a45404db9fc29fec655 Mon Sep 17 00:00:00 2001
From: Alexandru Hossu <[email protected]>
Date: Fri, 22 May 2026 02:45:27 +0200
Subject: [PATCH] staging: rtl8723bs: fix heap buffer overflow in
rtw_cfg80211_set_wpa_ie()
supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc stable <[email protected]>
Reviewed-by Luka Gejak <[email protected]>
Signed-off-by Alexandru Hossu <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +8 -0
@@ -1446,6 +1446,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa =rtw_get_wpa_ie (buf, &wpa_ielen, ielen);if (pwpa && wpa_ielen >0 ) { +if (wpa_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa_ie (pwpa, wpa_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
@@ -1455,6 +1459,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa2 =rtw_get_wpa2_ie (buf, &wpa2_ielen, ielen);if (pwpa2 && wpa2_ielen >0 ) { +if (wpa2_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
Sasha Levin
maintainerPATCH 1/3 staging: rtl8723bs: Fix indentation issues
From: Franziska Naepelt <[email protected]>
[ Upstream commit b59cba2309b16fa364df03e3693b8d45c3fadbd6 ]
Fix the following checkpatch indentation issues:
- WARNING: suspect code indent for conditional statements (32, 48)
- WARNING: suspect code indent for conditional statements (24, 24)
- ERROR: code indent should use tabs where possible
Signed-off-by Franziska Naepelt <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
Stable-dep-of: 5a752a616e75 ("staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()")
Signed-off-by Sasha Levin <[email protected]>
--- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +3 -3
@@ -582,7 +582,7 @@ static int rtw_cfg80211_ap_set_encryption(struct net_device *dev, struct ieee_pa psecuritypriv->dot118021XGrpPrivacy = _WEP40_;if (param->u.crypt.key_len ==13 ) - psecuritypriv->dot118021XGrpPrivacy = _WEP104_; + psecuritypriv->dot118021XGrpPrivacy = _WEP104_; }else if (strcmp (param->u.crypt.alg,"TKIP" ) ==0 ) { psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
@@ -1305,7 +1305,7 @@ static int cfg80211_rtw_scan(struct wiphy *wiphy }else if (request->n_channels <=4 ) {for (j = request->n_channels -1 ; j >=0 ; j--)for (i =0 ; i < survey_times; i++) -memcpy (&ch[j*survey_times+i], &ch[j],sizeof (struct rtw_ieee80211_channel )); +memcpy (&ch[j*survey_times+i], &ch[j],sizeof (struct rtw_ieee80211_channel )); _status =rtw_sitesurvey_cmd (padapter, ssid,RTW_SSID_SCAN_AMOUNT , ch, survey_times * request->n_channels); }else { _status =rtw_sitesurvey_cmd (padapter, ssid,RTW_SSID_SCAN_AMOUNT ,NULL ,0 );
@@ -2805,7 +2805,7 @@ int rtw_wdev_alloc(struct adapter *padapter, struct device *dev) wdev->netdev = pnetdev; wdev->iftype =NL80211_IFTYPE_STATION ;/* will be init in rtw_hal_init() */ -/* Must sync with _rtw_init_mlme_priv() */ +/* Must sync with _rtw_init_mlme_priv() */ /* pmlmepriv->fw_state = WIFI_STATION_STATE */ padapter->rtw_wdev = wdev; pnetdev->ieee80211_ptr = wdev;
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/3 staging: rtl8723bs: Fix space issues
From: Franziska Naepelt <[email protected]>
[ Upstream commit c4b811b9361b0d7ea167a79587f5ec0a13fd8863 ]
Fix the following checkpatch space issues:
- CHECK: spaces preferred around that '*' (ctx:VxV)
- CHECK: spaces preferred around that '+' (ctx:VxV)
- CHECK: spaces preferred around that '-' (ctx:VxV)
- CHECK: spaces preferred around that '|' (ctx:VxV)
- CHECK: No space is necessary after a cast
- WARNING: please, no spaces at the start of a line
Signed-off-by Franziska Naepelt <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
Stable-dep-of: 5a752a616e75 ("staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()")
Signed-off-by Sasha Levin <[email protected]>
--- .../staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 76 +++++++++---------- 1 file changed, 38 insertions(+), 38 deletions(-)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +38 -38
@@ -95,14 +95,14 @@ static struct ieee80211_channel rtw_2ghz_channels[] = {static void rtw_2g_channels_init (struct ieee80211_channel *channels) {memcpy ((void *)channels, (void *)rtw_2ghz_channels, -sizeof (struct ieee80211_channel )*RTW_2G_CHANNELS_NUM +sizeof (struct ieee80211_channel ) *RTW_2G_CHANNELS_NUM ); }static void rtw_2g_rates_init (struct ieee80211_rate *rates) {memcpy (rates, rtw_g_rates, -sizeof (struct ieee80211_rate )*RTW_G_RATES_NUM +sizeof (struct ieee80211_rate ) *RTW_G_RATES_NUM ); }
@@ -126,8 +126,8 @@ static struct ieee80211_supported_band *rtw_spt_band_alloc(if (!spt_band) goto exit; - spt_band->channels = (struct ieee80211_channel *)(((u8 *)spt_band)+sizeof (struct ieee80211_supported_band )); - spt_band->bitrates = (struct ieee80211_rate *)(((u8 *)spt_band->channels)+sizeof (struct ieee80211_channel )*n_channels); + spt_band->channels = (struct ieee80211_channel *)(((u8 *)spt_band) +sizeof (struct ieee80211_supported_band )); + spt_band->bitrates = (struct ieee80211_rate *)(((u8 *)spt_band->channels) +sizeof (struct ieee80211_channel ) * n_channels); spt_band->band = band; spt_band->n_channels = n_channels; spt_band->n_bitrates = n_bitrates;
@@ -247,10 +247,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wlu32 wpsielen =0 ;u8 *wpsie =NULL ; - wpsie =rtw_get_wps_ie (pnetwork->network.ies+_FIXED_IE_LENGTH_, pnetwork->network.ie_length-_FIXED_IE_LENGTH_,NULL , &wpsielen); + wpsie =rtw_get_wps_ie (pnetwork->network.ies + _FIXED_IE_LENGTH_, pnetwork->network.ie_length - _FIXED_IE_LENGTH_,NULL , &wpsielen);if (wpsie && wpsielen >0 ) - psr =rtw_get_wps_attr_content (wpsie, wpsielen,WPS_ATTR_SELECTED_REGISTRAR , (u8 *)(&sr),NULL ); + psr =rtw_get_wps_attr_content (wpsie, wpsielen,WPS_ATTR_SELECTED_REGISTRAR , (u8 *)(&sr),NULL );if (sr !=0 ) {/* it means under processing WPS */
@@ -277,9 +277,9 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl/* We've set wiphy's signal_type as CFG80211_SIGNAL_TYPE_MBM: signal strength in mBm (100*dBm) */ if (check_fwstate (pmlmepriv, _FW_LINKED) == true &&is_same_network (&pmlmepriv->cur_network.network, &pnetwork->network,0 )) { - notify_signal =100 *translate_percentage_to_dbm (padapter->recvpriv.signal_strength);/* dbm */ + notify_signal =100 *translate_percentage_to_dbm (padapter->recvpriv.signal_strength);/* dbm */ }else { - notify_signal =100 *translate_percentage_to_dbm (pnetwork->network.phy_info.signal_strength);/* dbm */ + notify_signal =100 *translate_percentage_to_dbm (pnetwork->network.phy_info.signal_strength);/* dbm */ } buf =kzalloc (MAX_BSSINFO_LEN ,GFP_ATOMIC );
@@ -453,20 +453,20 @@ void rtw_cfg80211_indicate_connect(struct adapter *padapter) roam_info.channel = notify_channel; roam_info.bssid = cur_network->network.mac_address; roam_info.req_ie = - pmlmepriv->assoc_req+sizeof (struct ieee80211_hdr_3addr )+2 ; + pmlmepriv->assoc_req +sizeof (struct ieee80211_hdr_3addr ) +2 ; roam_info.req_ie_len = - pmlmepriv->assoc_req_len-sizeof (struct ieee80211_hdr_3addr )-2 ; + pmlmepriv->assoc_req_len -sizeof (struct ieee80211_hdr_3addr ) -2 ; roam_info.resp_ie = - pmlmepriv->assoc_rsp+sizeof (struct ieee80211_hdr_3addr )+6 ; + pmlmepriv->assoc_rsp +sizeof (struct ieee80211_hdr_3addr ) +6 ; roam_info.resp_ie_len = - pmlmepriv->assoc_rsp_len-sizeof (struct ieee80211_hdr_3addr )-6 ; + pmlmepriv->assoc_rsp_len -sizeof (struct ieee80211_hdr_3addr ) -6 ;cfg80211_roamed (padapter->pnetdev, &roam_info,GFP_ATOMIC ); }else {cfg80211_connect_result (padapter->pnetdev, cur_network->network.mac_address - , pmlmepriv->assoc_req+sizeof (struct ieee80211_hdr_3addr )+2 - , pmlmepriv->assoc_req_len-sizeof (struct ieee80211_hdr_3addr )-2 - , pmlmepriv->assoc_rsp+sizeof (struct ieee80211_hdr_3addr )+6 - , pmlmepriv->assoc_rsp_len-sizeof (struct ieee80211_hdr_3addr )-6 + , pmlmepriv->assoc_req +sizeof (struct ieee80211_hdr_3addr ) +2 + , pmlmepriv->assoc_req_len -sizeof (struct ieee80211_hdr_3addr ) -2 + , pmlmepriv->assoc_rsp +sizeof (struct ieee80211_hdr_3addr ) +6 + , pmlmepriv->assoc_rsp_len -sizeof (struct ieee80211_hdr_3addr ) -6 ,WLAN_STATUS_SUCCESS ,GFP_ATOMIC ); } }
@@ -721,7 +721,7 @@ static int rtw_cfg80211_set_encryption(struct net_device *dev, struct ieee_param param->u.crypt.err =0 ; param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN -1 ] ='\0' ; -if (param_len < (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len) { +if (param_len < (u32)((u8 *)param->u.crypt.key - (u8 *)param) + param->u.crypt.key_len) { ret = -EINVAL ; goto exit; }
@@ -1035,10 +1035,10 @@ static int cfg80211_rtw_get_station(struct wiphy *wiphy, }/* for Ad-Hoc/AP mode */ -if ((check_fwstate (pmlmepriv,WIFI_ADHOC_STATE ) - ||check_fwstate (pmlmepriv,WIFI_ADHOC_MASTER_STATE ) - ||check_fwstate (pmlmepriv,WIFI_AP_STATE )) - &&check_fwstate (pmlmepriv, _FW_LINKED)) { +if ((check_fwstate (pmlmepriv,WIFI_ADHOC_STATE ) || +check_fwstate (pmlmepriv,WIFI_ADHOC_MASTER_STATE ) || +check_fwstate (pmlmepriv,WIFI_AP_STATE )) && +check_fwstate (pmlmepriv, _FW_LINKED)) {/* TODO: should acquire station info... */ }
@@ -1237,7 +1237,7 @@ static int cfg80211_rtw_scan(struct wiphy *wiphyspin_unlock_bh (&pwdev_priv->scan_req_lock);if (check_fwstate (pmlmepriv,WIFI_AP_STATE ) == true) { -if (check_fwstate (pmlmepriv,WIFI_UNDER_WPS |_FW_UNDER_SURVEY|_FW_UNDER_LINKING) == true) { +if (check_fwstate (pmlmepriv,WIFI_UNDER_WPS | _FW_UNDER_SURVEY | _FW_UNDER_LINKING) == true) { need_indicate_scan_done = true; goto check_need_indicate_scan_done; }
@@ -1291,7 +1291,7 @@ static int cfg80211_rtw_scan(struct wiphy *wiphy }/* parsing channels, n_channels */ -memset (ch,0 ,sizeof (struct rtw_ieee80211_channel )*RTW_CHANNEL_SCAN_AMOUNT ); +memset (ch,0 ,sizeof (struct rtw_ieee80211_channel ) *RTW_CHANNEL_SCAN_AMOUNT );for (i =0 ; i < request->n_channels && i <RTW_CHANNEL_SCAN_AMOUNT ; i++) { ch[i].hw_value = request->channels[i]->hw_value; ch[i].flags = request->channels[i]->flags;
@@ -1305,7 +1305,7 @@ static int cfg80211_rtw_scan(struct wiphy *wiphy }else if (request->n_channels <=4 ) {for (j = request->n_channels -1 ; j >=0 ; j--)for (i =0 ; i < survey_times; i++) -memcpy (&ch[j*survey_times+i], &ch[j],sizeof (struct rtw_ieee80211_channel )); +memcpy (&ch[j * survey_times + i], &ch[j],sizeof (struct rtw_ieee80211_channel )); _status =rtw_sitesurvey_cmd (padapter, ssid,RTW_SSID_SCAN_AMOUNT , ch, survey_times * request->n_channels); }else { _status =rtw_sitesurvey_cmd (padapter, ssid,RTW_SSID_SCAN_AMOUNT ,NULL ,0 );
@@ -1461,7 +1461,7 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel goto exit; } -if (ielen >MAX_WPA_IE_LEN +MAX_WPS_IE_LEN +MAX_P2P_IE_LEN ) { +if (ielen >MAX_WPA_IE_LEN +MAX_WPS_IE_LEN +MAX_P2P_IE_LEN ) { ret = -EINVAL ; goto exit; }
@@ -1481,19 +1481,19 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa =rtw_get_wpa_ie (buf, &wpa_ielen, ielen);if (pwpa && wpa_ielen >0 ) { -if (rtw_parse_wpa_ie (pwpa, wpa_ielen+2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { +if (rtw_parse_wpa_ie (pwpa, wpa_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK; -memcpy (padapter->securitypriv.supplicant_ie, &pwpa[0 ], wpa_ielen+2 ); +memcpy (padapter->securitypriv.supplicant_ie, &pwpa[0 ], wpa_ielen +2 ); } } pwpa2 =rtw_get_wpa2_ie (buf, &wpa2_ielen, ielen);if (pwpa2 && wpa2_ielen >0 ) { -if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen+2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { +if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK; -memcpy (padapter->securitypriv.supplicant_ie, &pwpa2[0 ], wpa2_ielen+2 ); +memcpy (padapter->securitypriv.supplicant_ie, &pwpa2[0 ], wpa2_ielen +2 ); } }
@@ -1891,7 +1891,7 @@ static int cfg80211_rtw_set_pmksa(struct wiphy *wiphy,memcpy (psecuritypriv->PMKIDList[index].PMKID, (u8 *)pmksa->pmkid,WLAN_PMKID_LEN ); psecuritypriv->PMKIDList[index].bUsed = true; - psecuritypriv->PMKIDIndex = index+1 ; + psecuritypriv->PMKIDIndex = index +1 ; blInserted = true;break ; }
@@ -2090,8 +2090,8 @@ static netdev_tx_t rtw_cfg80211_monitor_if_xmit_entry(struct sk_buff *skb, struc/* Use the real net device to transmit the packet */ return _rtw_xmit_entry (skb, padapter->pnetdev); - }else if ((frame_control & (IEEE80211_FCTL_FTYPE |IEEE80211_FCTL_STYPE )) == - (IEEE80211_FTYPE_MGMT |IEEE80211_STYPE_ACTION )) { + }else if ((frame_control & (IEEE80211_FCTL_FTYPE |IEEE80211_FCTL_STYPE )) == + (IEEE80211_FTYPE_MGMT |IEEE80211_STYPE_ACTION )) {/* only for action frames */ struct xmit_frame *pmgntframe;struct pkt_attrib *pattrib;
@@ -2205,7 +2205,7 @@ static int rtw_cfg80211_add_monitor_if(struct adapter *padapter, char *name, str goto out; *ndev = pwdev_priv->pmon_ndev = mon_ndev; -memcpy (pwdev_priv->ifname_mon, name,IFNAMSIZ +1 ); +memcpy (pwdev_priv->ifname_mon, name,IFNAMSIZ +1 ); out:if (ret && mon_wdev) {
@@ -2299,14 +2299,14 @@ static int rtw_add_beacon(struct adapter *adapter, const u8 *head, size_t head_lif (head_len <24 )return -EINVAL ; - pbuf =rtw_zmalloc (head_len+tail_len); + pbuf =rtw_zmalloc (head_len + tail_len);if (!pbuf)return -ENOMEM ; -memcpy (pbuf, (void *)head+24 , head_len-24 );/* 24 =beacon header len. */ -memcpy (pbuf+head_len-24 , (void *)tail, tail_len); +memcpy (pbuf, (void *)head +24 , head_len -24 );/* 24 =beacon header len. */ +memcpy (pbuf + head_len -24 , (void *)tail, tail_len); - len = head_len+tail_len-24 ; + len = head_len + tail_len -24 ;/* check wps ie if inclued */ rtw_get_wps_ie (pbuf + _FIXED_IE_LENGTH_, len - _FIXED_IE_LENGTH_,NULL , &wps_ielen);
@@ -2595,7 +2595,7 @@ static int cfg80211_rtw_mgmt_tx(struct wiphy *wiphy, pwdev_priv =adapter_wdev_data (padapter);/* cookie generation */ - *cookie = (unsigned long ) buf; + *cookie = (unsigned long )buf;/* indicate ack before issue frame to avoid racing with rsp frame */ rtw_cfg80211_mgmt_tx_status (padapter, *cookie, buf, len, ack,GFP_KERNEL );
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/3 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
In reply to Sasha LevinFrom: Alexandru Hossu <[email protected]>
[ Upstream commit 5a752a616e756844388a1a45404db9fc29fec655 ]
supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc stable <[email protected]>
Reviewed-by Luka Gejak <[email protected]>
Signed-off-by Alexandru Hossu <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
Signed-off-by Sasha Levin <[email protected]>
--- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +8 -0
@@ -1481,6 +1481,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa =rtw_get_wpa_ie (buf, &wpa_ielen, ielen);if (pwpa && wpa_ielen >0 ) { +if (wpa_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa_ie (pwpa, wpa_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
@@ -1490,6 +1494,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa2 =rtw_get_wpa2_ie (buf, &wpa2_ielen, ielen);if (pwpa2 && wpa2_ielen >0 ) { +if (wpa2_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
Signature · 1 line
2.53.0