From: iLifetruth <yixiaonn@gmail.com>
To: Fabio Aiuto <fabioaiuto83@gmail.com>
Cc: gregkh@linuxfoundation.org, ross.schm.dev@gmail.com,
marcocesati@gmail.com, insafonov@gmail.com,
linux-kernel@vger.kernel.org, Qiang Liu <cyruscyliu@gmail.com>,
yajin@vm-kernel.org, hdegoede@redhat.com,
Larry.Finger@lwfinger.net, Martin Kaiser <martin@kaiser.cx>,
Phillip Potter <phil@philpotter.co.uk>,
Michael Straube <straube.linux@gmail.com>,
fmdefrancesco@gmail.com, linux-staging@lists.linux.dev,
paskripkin@gmail.com
Subject: Re: staging: possible buffer overflow in rtw_wx_set_scan function in driver/staging/rtl8723bs
Date: Tue, 24 Aug 2021 16:47:26 +0800 [thread overview]
Message-ID: <CABv53a9x_FbTY0=D_TGsHdS3XsUVg5M=S5WYVNdQXaVSC=XVYQ@mail.gmail.com> (raw)
In-Reply-To: <20210824074643.GA1731@agape.jhs>
On Tue, Aug 24, 2021 at 3:46 PM Fabio Aiuto <fabioaiuto83@gmail.com> wrote:
>
> Hello,
>
> [sorry for resend, I updated the CC field]
>
> On Tue, Aug 24, 2021 at 03:04:04PM +0800, iLifetruth wrote:
> > Here are the fixes and the contents of the patch file we suggest.
> >
> > [PATCH]staging: rtl8723bs: prevent ->ssid overflow in rtw_wx_set_scan()
> >
> > This fixing patch is ported from the upstream commit
> > 74b6b20df8cf(staging: rtl8188eu: prevent ->ssid overflow in
> > rtw_wx_set_scan()) which fixes on another driver numbered rtl8188eu.
> > This code has a check to prevent read overflow but it needs another
> > check to prevent writing beyond the end of the ->ssid[] array in
> > driver rtl8723bs.
> >
> > ---
> > drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> > b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> > index f95000df8942..3b859b71bf43 100644
> > --- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> > +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> > @@ -1222,9 +1222,9 @@ static int rtw_wx_set_scan(struct net_device
> > *dev, struct iw_request_info *a,
> >
> > sec_len = *(pos++); len -= 1;
> >
> > - if (sec_len > 0 && sec_len <= len) {
> > + if (sec_len > 0 && sec_len <= len &&
> > sec_len<= 32) {
> > ssid[ssid_index].SsidLength = sec_len;
> > - memcpy(ssid[ssid_index].Ssid,
> > pos, ssid[ssid_index].SsidLength);
> > + memcpy(ssid[ssid_index].Ssid,
> > pos, sec_len);
> > ssid_index++;
> > }
> >
> > --
> >
> > Thanks for your confirmation,
> > - iLifetruth
> >
>
> the patch looks fine. Just some points:
>
> - If the patch related to wext support removal will
> be accepted, the patch isn't necessary. So I will wait
> until I know the community-maintainer decision.
>
OK, I see the situation now, and I will submit a relevant patch to the
Linux-staging tree at a suitable time.
prev parent reply other threads:[~2021-08-24 8:48 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CABv53a_q4jzsXib7ovRs=eOwqcQ-oKb8c7DA7uUSPf+0tt6aog@mail.gmail.com>
[not found] ` <20210823170624.GA1420@agape.jhs>
2021-08-24 2:07 ` staging: possible buffer overflow in rtw_wx_set_scan function in driver/staging/rtl8723bs iLifetruth
2021-08-24 7:04 ` iLifetruth
2021-08-24 7:28 ` Greg KH
2021-08-24 7:40 ` Fabio Aiuto
2021-08-24 7:46 ` Fabio Aiuto
2021-08-24 8:47 ` iLifetruth [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CABv53a9x_FbTY0=D_TGsHdS3XsUVg5M=S5WYVNdQXaVSC=XVYQ@mail.gmail.com' \
--to=yixiaonn@gmail.com \
--cc=Larry.Finger@lwfinger.net \
--cc=cyruscyliu@gmail.com \
--cc=fabioaiuto83@gmail.com \
--cc=fmdefrancesco@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=hdegoede@redhat.com \
--cc=insafonov@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=marcocesati@gmail.com \
--cc=martin@kaiser.cx \
--cc=paskripkin@gmail.com \
--cc=phil@philpotter.co.uk \
--cc=ross.schm.dev@gmail.com \
--cc=straube.linux@gmail.com \
--cc=yajin@vm-kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).