patch "staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data()." added to staging-linus

PATCH [email protected] 2 participants 3 messages Jul 2, 2018 – Jul 3, 2018

Subsystems (2)

Stable branch Staging

lore

Share & tools

lore

[email protected]

author maintainer Applied

2018-07-02 08:48 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data().

to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.

If you have any questions about this process, please let me know.

Quoted 1 line

From 920c92448839bd4f8eb87a92b08cad56d449caff Mon Sep 17 00:00:00 2001

From: Murray McAllister <[email protected]>
Date: Mon, 2 Jul 2018 13:07:28 +1200
Subject: staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data().

Dan Carpenter reported an integer underflow issue in the rtl8188eu driver. This is also needed for the length (signed integer) in rtl8723bs, as it is later converted to an unsigned integer and used in a memcpy operation.

Original issue is at https://patchwork.kernel.org/patch/9796371/

Reported-by Dan Carpenter <[email protected]>

Signed-off-by Murray McAllister <[email protected]>

Cc stable <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/rtl8723bs/core/rtw_ap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/staging/rtl8723bs/core/rtw_ap.c +1 -1

index 45c05527a57a..faf4b4158cfa 100644
@@ -1051,7 +1051,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
 		return _FAIL;
 
 
-	if (len > MAX_IE_SZ)
+	if (len < 0 || len > MAX_IE_SZ)
 		return _FAIL;
 
 	pbss_network->IELength = len;

Signature · 1 line

2.18.0

Dan Carpenter

2018-07-03 10:43 UTC #1 lore raw

Quoted 23 lines · On Mon, Jul 02, 2018 at 10:48:41AM +0200, [email protected] wrote:

This is a note to let you know that I've just added the patch titled
staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data().
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.
If you have any questions about this process, please let me know.
Quoted 1 line
From 920c92448839bd4f8eb87a92b08cad56d449caff Mon Sep 17 00:00:00 2001
From: Murray McAllister <[email protected]>
Date: Mon, 2 Jul 2018 13:07:28 +1200
Subject: staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data().

Quoted 7 lines

Dan Carpenter reported an integer underflow issue in the rtl8188eu driver. This is also needed for the length (signed integer) in rtl8723bs, as it is later converted to an unsigned integer and used in a memcpy operation.
Original issue is at https://patchwork.kernel.org/patch/9796371/
Reported-by Dan Carpenter <[email protected]>

Greg, you gave me Reported-by credit for this but really Murray found it on his own. It was slightly confusing perhaps from the commit message.

regards,
dan carpenter

Greg KH

author maintainer

2018-07-03 10:51 UTC #2 lore raw

Quoted 28 lines · Dan Carpenter

Quoted 27 lines · On Mon, Jul 02, 2018 at 10:48:41AM +0200, [email protected] wrote:
This is a note to let you know that I've just added the patch titled
staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data().
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.
If you have any questions about this process, please let me know.
Quoted 1 line
From 920c92448839bd4f8eb87a92b08cad56d449caff Mon Sep 17 00:00:00 2001
From: Murray McAllister <[email protected]>
Date: Mon, 2 Jul 2018 13:07:28 +1200
Subject: staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data().
Dan Carpenter reported an integer underflow issue in the rtl8188eu driver. This is also needed for the length (signed integer) in rtl8723bs, as it is later converted to an unsigned integer and used in a memcpy operation.

Quoted 6 lines

Quoted 3 lines
Original issue is at https://patchwork.kernel.org/patch/9796371/
Reported-by Dan Carpenter <[email protected]>
Greg, you gave me Reported-by credit for this but really Murray found it on his own. It was slightly confusing perhaps from the commit message.

Sorry about that, the commit message was confusing :(