staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan()

PATCH In review Dan Carpenter 5 participants 19 messages Mar 5, 2021 – May 26, 2022

Subsystems (3)

Stable branch Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2021-03-05 08:59 UTC #0 lore raw

PATCH 1/1 staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan()

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->ssid[] array.

Fixes a2c60d42d97c ("staging: r8188eu: Add files for new driver - part 16")

Signed-off-by Dan Carpenter <[email protected]>

---
 drivers/staging/rtl8188eu/os_dep/ioctl_linux.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/staging/rtl8188eu/os_dep/ioctl_linux.c +4 -2

index bf22f130d3e1..58954b88a817 100644
@@ -1133,9 +1133,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
 						break;
 					}
 					sec_len = *(pos++); len -= 1;
-					if (sec_len > 0 && sec_len <= len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].ssid_length = sec_len;
-						memcpy(ssid[ssid_index].ssid, pos, ssid[ssid_index].ssid_length);
+						memcpy(ssid[ssid_index].ssid, pos, sec_len);
 						ssid_index++;
 					}
 					pos += sec_len;

Signature · 1 line

2.30.1

Edmundo Carmona Antoranz

2021-03-05 16:59 UTC #1 lore raw

drivers/staging/rtl8188eu/os_dep/ioctl_linux.c static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a, · line 1138

Quoted 4 lines · Dan Carpenter

drivers/staging/rtl8188eu/os_dep/ioctl_linux.c +3 -1

-                                       if (sec_len > 0 && sec_len <= len) {
+                                       if (sec_len > 0 &&
+                                           sec_len <= len &&
+                                           sec_len <= 32) {

I wonder if this could be reduced to (sec_len > 0 && sec_len <= min(len, 32)) from a stylistic POV?

First attempt at something kernel related so I know there's plenty of things to learn (including patterns for problems like this and etiquette).

Dan Carpenter

author

2021-03-05 21:10 UTC #2 lore raw

Quoted 8 lines · Edmundo Carmona Antoranz

drivers/staging/rtl8188eu/os_dep/ioctl_linux.c static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a, · line 1138
Quoted 4 lines · Dan Carpenter
drivers/staging/rtl8188eu/os_dep/ioctl_linux.c +3 -1
-                                       if (sec_len > 0 && sec_len <= len) {
+                                       if (sec_len > 0 &&
+                                           sec_len <= len &&
+                                           sec_len <= 32) {
I wonder if this could be reduced to (sec_len > 0 && sec_len <= min(len, 32)) from a stylistic POV?

I kind of prefer it the way I wrote it. I prefer conditions split apart and done ploddingly, one at a time... You'll notice how I could have written it like:

					if (sec_len > 0 && sec_len <= len &&
					    sec_len <= 32) {

But I really like my conditions to be spelled out so the "sec_len" is perfectly aligned in each part of the condition. Your way would be to combine two conditions into one part of a line and seems sneaky.

Quoted 4 lines

First attempt at something kernel related so I know there's plenty of things to learn (including patterns for problems like this and etiquette).

It's good that you're reviewing code... We try to be predictable though and no one would have predicted your response. Ideally patch review should be like, "Ugh! Why didn't I think of that? Of course, we should propagate the error code." Or "Oh, I didn't know checkpatch warns about that."

The truth is that I don't always agree with all of Greg's reviews. He is more strict than I am about breaking up patches into multiple things. (It's a tricky line to define for me). But I can always predict what Greg will say in a review so that saves time when I know which patches he will accept and which he won't.

regards,
dan carpenter

Edmundo Carmona Antoranz

2021-03-05 18:56 UTC #3 lore raw

Quoted 2 lines · Dan Carpenter

It's good that you're reviewing code...

Right now watching the patches flow feels like I'm just shadowing. Later, when I get the hang of it, I might try providing something on my own. I'll just watch things from a distance for the time being perhaps making questions here or there (like I just did).

Just in case, my main point was to use a min() (or MIN? whatever way it's provided in the standard) to have only two conditions instead of three... .to keep them on separate lines, it could be done like this:

    if (sec_len > 0 &&
        sec_len <= min(len, 32)) {

_but_ I understand if you would rather keep the 3 conditions.

Thanks for your comment.

Denis Efremov

2022-05-18 07:01 UTC #4 lore raw

PATCH 1/1 staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()

In reply to Dan Carpenter

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.

Fixes 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")

Cc stable <[email protected]>

Signed-off-by Denis Efremov <[email protected]>

---

This patch is a copy of Dan's 74b6b20df8cf (CVE-2021-28660). Drivers r8188eu and rtl8188eu share the same code.

 drivers/staging/r8188eu/os_dep/ioctl_linux.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/staging/r8188eu/os_dep/ioctl_linux.c +4 -2

index eb9375b0c660..a2692ce02bc2 100644
@@ -1131,9 +1131,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
 						break;
 					}
 					sec_len = *(pos++); len -= 1;
-					if (sec_len > 0 && sec_len <= len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].SsidLength = sec_len;
-						memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						memcpy(ssid[ssid_index].Ssid, pos, sec_len);
 						ssid_index++;
 					}
 					pos += sec_len;

Signature · 1 line

2.35.3

Denis Efremov

2022-05-18 07:49 UTC #5 lore raw

Re: [PATCH] staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()

Quoted 10 lines · Denis Efremov

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.
Fixes 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
Cc stable <[email protected]>
Signed-off-by Denis Efremov <[email protected]>
---
This patch is a copy of Dan's 74b6b20df8cf (CVE-2021-28660). Drivers r8188eu and rtl8188eu share the same code.

I also found same code pattern in rtl8723bs driver in stable kernels 5.10, 5.4, 4.19, 4.14.
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c?h=linux-5.10.y#n1354
I can send the same fix to stable trees if appropriate.

Quoted 22 lines

 drivers/staging/r8188eu/os_dep/ioctl_linux.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/staging/r8188eu/os_dep/ioctl_linux.c +4 -2

index eb9375b0c660..a2692ce02bc2 100644
@@ -1131,9 +1131,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
 						break;
 					}
 					sec_len = *(pos++); len -= 1;
-					if (sec_len > 0 && sec_len <= len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].SsidLength = sec_len;
-						memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						memcpy(ssid[ssid_index].Ssid, pos, sec_len);
 						ssid_index++;
 					}
 					pos += sec_len;

Greg KH

maintainer

2022-05-19 15:40 UTC #6 lore raw

Re: [PATCH] staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()

Quoted 11 lines · Denis Efremov

Quoted 8 lines · Denis Efremov
This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.
Fixes 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
Cc stable <[email protected]>
Signed-off-by Denis Efremov <[email protected]>
---

Quoted 7 lines

Quoted 2 lines
This patch is a copy of Dan's 74b6b20df8cf (CVE-2021-28660). Drivers r8188eu and rtl8188eu share the same code.
I also found same code pattern in rtl8723bs driver in stable kernels 5.10, 5.4, 4.19, 4.14.
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c?h=linux-5.10.y#n1354
I can send the same fix to stable trees if appropriate.

Please do!

thanks,

greg k-h

Denis Efremov (Oracle)

2022-05-20 03:57 UTC #7 lore raw

PATCH 1/1 staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.

Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")

Cc stable <[email protected]>

Signed-off-by Denis Efremov (Oracle) <[email protected]>

---
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +4 -2

index 902ac8169948..083ff72976cf 100644
@@ -1351,9 +1351,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
 
 					sec_len = *(pos++); len -= 1;
 
-					if (sec_len > 0 && sec_len <= len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].SsidLength = sec_len;
-						memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						memcpy(ssid[ssid_index].Ssid, pos, sec_len);
 						/* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */
 						/* 	, ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */
 						ssid_index++;

Signature · 1 line

2.35.3

Greg KH

maintainer

2022-05-23 15:26 UTC #8 lore raw

Re: [PATCH v5.10] staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()

Quoted 9 lines · Denis Efremov (Oracle)

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.
Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc stable <[email protected]>
Signed-off-by Denis Efremov (Oracle) <[email protected]>
---
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

And only 5.10 needs this? What about all other kernel branches?

thanks,

greg k-h

Denis Efremov

2022-05-23 17:41 UTC #9 lore raw

Re: [PATCH v5.10] staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()

Hi,

Quoted 4 lines · Greg KH

Quoted 3 lines · Denis Efremov (Oracle)
This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.

Quoted 9 lines

Quoted 6 lines
Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc stable <[email protected]>
Signed-off-by Denis Efremov (Oracle) <[email protected]>
---
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
And only 5.10 needs this? What about all other kernel branches?

From 5.10, 5.4, 4.19, to 4.14.

There is a small spaces conflict in 5.4-4.14 kernels because of c77761d660a6 staging: rtl8723bs: Fix spacing issues

I sent another patch to handle it.

Thanks,
Denis

Greg KH

maintainer

2022-05-26 12:05 UTC #10 lore raw

Re: [PATCH v5.10] staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()

Quoted 17 lines · Denis Efremov

Hi,
Quoted 13 lines · Greg KH
Quoted 9 lines · Denis Efremov (Oracle)
This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.
Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc stable <[email protected]>
Signed-off-by Denis Efremov (Oracle) <[email protected]>
---
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
And only 5.10 needs this? What about all other kernel branches?

Quoted 6 lines

Quoted 1 line
From 5.10, 5.4, 4.19, to 4.14.
There is a small spaces conflict in 5.4-4.14 kernels because of c77761d660a6 staging: rtl8723bs: Fix spacing issues
I sent another patch to handle it.

Thanks, all now queued up.

greg k-h

[email protected]

maintainer Applied

2022-05-26 12:06 UTC #11 lore raw

Patch "staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()" has been added to the 5.10-stable tree

In reply to Denis Efremov (Oracle)

This is a note to let you know that I've just added the patch titled

    staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()

to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From [email protected] Thu May 26 14:03:56 2022
From: "Denis Efremov (Oracle)" <[email protected]>
Date: Fri, 20 May 2022 07:57:30 +0400
Subject: staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
To: [email protected]
Cc: "Denis Efremov (Oracle)" <[email protected]>, [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], stable <[email protected]>
Message-ID: <[email protected]>

From: "Denis Efremov (Oracle)" <[email protected]>

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.

Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")

Cc stable <[email protected]>

Signed-off-by Denis Efremov (Oracle) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +4 -2

@@ -1351,9 +1351,11 @@ static int rtw_wx_set_scan(struct net_de
 
 					sec_len = *(pos++); len -= 1;
 
-					if (sec_len > 0 && sec_len <= len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].SsidLength = sec_len;
-						memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						memcpy(ssid[ssid_index].Ssid, pos, sec_len);
 						/* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */
 						/* 	, ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */
 						ssid_index++;

Patches currently in stable-queue which might be from [email protected] are

queue-5.10/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch

Denis Efremov (Oracle)

2022-05-23 17:40 UTC #12 lore raw

PATCH 1/1 staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()

In reply to Greg KH

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.

Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")

Cc stable <[email protected]>

Signed-off-by Denis Efremov (Oracle) <[email protected]>

---
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +4 -2

index d8d44fd9a92f..ea2fd3a73c3a 100644
@@ -1351,9 +1351,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
 
 					sec_len = *(pos++); len-= 1;
 
-					if (sec_len>0 && sec_len<=len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].SsidLength = sec_len;
-						memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						memcpy(ssid[ssid_index].Ssid, pos, sec_len);
 						/* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */
 						/* 	, ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */
 						ssid_index++;

Signature · 1 line

2.36.1

[email protected]

maintainer Applied

2022-05-26 12:05 UTC #13 lore raw

Patch "staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()" has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

    staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From [email protected] Thu May 26 14:03:14 2022
From: "Denis Efremov (Oracle)" <[email protected]>
Date: Mon, 23 May 2022 21:39:43 +0400
Subject: staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
To: [email protected]
Cc: "Denis Efremov (Oracle)" <[email protected]>, [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], stable <[email protected]>
Message-ID: <[email protected]>

From: "Denis Efremov (Oracle)" <[email protected]>

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.

Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")

Cc stable <[email protected]>

Signed-off-by Denis Efremov (Oracle) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +4 -2

@@ -1438,9 +1438,11 @@ static int rtw_wx_set_scan(struct net_de
 
 					sec_len = *(pos++); len-= 1;
 
-					if (sec_len>0 && sec_len<=len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].SsidLength = sec_len;
-						memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						memcpy(ssid[ssid_index].Ssid, pos, sec_len);
 						/* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */
 						/* 	, ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */
 						ssid_index++;

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch

[email protected]

maintainer Applied

2022-05-26 12:05 UTC #14 lore raw

Patch "staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()" has been added to the 4.19-stable tree

In reply to Denis Efremov (Oracle)

This is a note to let you know that I've just added the patch titled

    staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()

to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Denis Efremov (Oracle)" <[email protected]>

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.

Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")

Cc stable <[email protected]>

Signed-off-by Denis Efremov (Oracle) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +4 -2

@@ -1359,9 +1359,11 @@ static int rtw_wx_set_scan(struct net_de
 
 					sec_len = *(pos++); len-= 1;
 
-					if (sec_len>0 && sec_len<=len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].SsidLength = sec_len;
-						memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						memcpy(ssid[ssid_index].Ssid, pos, sec_len);
 						/* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */
 						/* 	, ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */
 						ssid_index++;

Patches currently in stable-queue which might be from [email protected] are

queue-4.19/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch

[email protected]

maintainer Applied

2022-05-26 12:06 UTC #15 lore raw

Patch "staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()" has been added to the 5.4-stable tree

In reply to Denis Efremov (Oracle)

This is a note to let you know that I've just added the patch titled

    staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()

to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Denis Efremov (Oracle)" <[email protected]>

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.

Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")

Cc stable <[email protected]>

Signed-off-by Denis Efremov (Oracle) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +4 -2

@@ -1351,9 +1351,11 @@ static int rtw_wx_set_scan(struct net_de
 
 					sec_len = *(pos++); len-= 1;
 
-					if (sec_len>0 && sec_len<=len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].SsidLength = sec_len;
-						memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						memcpy(ssid[ssid_index].Ssid, pos, sec_len);
 						/* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */
 						/* 	, ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */
 						ssid_index++;

Patches currently in stable-queue which might be from [email protected] are

queue-5.4/staging-rtl8723bs-prevent-ssid-overflow-in-rtw_wx_set_scan.patch

Greg KH

maintainer

2022-05-19 15:45 UTC #16 lore raw

Re: [PATCH] staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()

In reply to Denis Efremov

Quoted 10 lines · Denis Efremov

This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.
Fixes 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
Cc stable <[email protected]>
Signed-off-by Denis Efremov <[email protected]>
---
This patch is a copy of Dan's 74b6b20df8cf (CVE-2021-28660). Drivers r8188eu and rtl8188eu share the same code.

This does not apply to my tree at all. This file is not present anymore, what tree did you make it against?

confused,

greg k-h

Dan Carpenter

author

2022-05-19 17:16 UTC #17 lore raw

Re: [PATCH] staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()

Quoted 9 lines · Greg KH

Quoted 8 lines · Denis Efremov
This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.
Fixes 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
Cc stable <[email protected]>
Signed-off-by Denis Efremov <[email protected]>
---

Quoted 6 lines

Quoted 2 lines
This patch is a copy of Dan's 74b6b20df8cf (CVE-2021-28660). Drivers r8188eu and rtl8188eu share the same code.
This does not apply to my tree at all. This file is not present anymore, what tree did you make it against?

That's weird. It applies fine for me on today's linux-next.

regards,
dan carpenter

Greg KH

maintainer

2022-05-19 17:36 UTC #18 lore raw

Re: [PATCH] staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()

Quoted 10 lines · Dan Carpenter

Quoted 9 lines · Greg KH
Quoted 8 lines · Denis Efremov
This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.
Fixes 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
Cc stable <[email protected]>
Signed-off-by Denis Efremov <[email protected]>
---

Quoted 8 lines

Quoted 6 lines
Quoted 2 lines
This patch is a copy of Dan's 74b6b20df8cf (CVE-2021-28660). Drivers r8188eu and rtl8188eu share the same code.
This does not apply to my tree at all. This file is not present anymore, what tree did you make it against?
That's weird. It applies fine for me on today's linux-next.

Ok, really wierd, it worked this time. I'll blame my email setup somehow, I was churning through lots of patches at once...

thanks for checking.

greg k-h