mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 14:33:24 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Browse Source 
Pull staging driver fixes from Greg KH:
 "Here are some more small staging driver fixes, just for the rtl8723bs
  driver, for some reported problems found with it now that people are
  starting to actually test the thing with "bad" networks.

  Nothing major, but good to have in the -final release. All of these
  have been in linux-next for over a week with no reported problems"

* tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8723bs: validate monitor transmit frame lengths
  staging: rtl8723bs: fix missing shared-key auth challenge length check
  staging: rtl8723bs: fix OOB read in WMM_param_handler()
  staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
This commit is contained in:
Linus Torvalds
2026-08-08 16:29:33 -07:00
parent 5668ba2304 6829665d05
commit e663f6deac
4 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/staging/rtl8723bs/core/rtw_ieee80211.c
View File

@@ -371,6 +371,9 @@ unsigned char *rtw_get_wpa_ie(unsigned char *pie, int *wpa_ie_len, int limit)
pbuf = rtw_get_ie(pbuf, WLAN_EID_VENDOR_SPECIFIC, &len, limit_new);
if (pbuf) {
if (len < 6)
goto check_next_ie;
/* check if oui matches... */
if (memcmp((pbuf + 2), wpa_oui_type, sizeof(wpa_oui_type)))
goto check_next_ie;

2
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
View File

@@ -879,7 +879,7 @@ unsigned int OnAuthClient(struct adapter *padapter, union recv_frame *precv_fram
p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&len,
pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
if (!p)
if (!p || len != WLAN_AUTH_CHALLENGE_LEN)
goto authclnt_fail;
memcpy(pmlmeinfo->chg_txt, p + 2, len);

3
drivers/staging/rtl8723bs/core/rtw_wlan_util.c
View File

@@ -666,6 +666,9 @@ int WMM_param_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)
return false;
}
if (pIE->length != WLAN_WMM_LEN)
return false;
if (!memcmp(&(pmlmeinfo->WMM_param), (pIE->data + 6), sizeof(struct WMM_para_element)))
return false;

4
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
View File

@@ -2033,6 +2033,8 @@ static netdev_tx_t rtw_cfg80211_monitor_if_xmit_entry(struct sk_buff *skb, struc
/* Skip the ratio tap header */
skb_pull(skb, rtap_len);
if (skb->len < dot11_hdr_len)
goto fail;
dot11_hdr = (struct ieee80211_hdr *)skb->data;
frame_control = le16_to_cpu(dot11_hdr->frame_control);
@@ -2045,6 +2047,8 @@ static netdev_tx_t rtw_cfg80211_monitor_if_xmit_entry(struct sk_buff *skb, struc
qos_len = 2;
if ((frame_control & 0x0300) == 0x0300)
dot11_hdr_len += 6;
if (skb->len < dot11_hdr_len + qos_len + snap_len)
goto fail;
memcpy(dst_mac_addr, dot11_hdr->addr1, sizeof(dst_mac_addr));
memcpy(src_mac_addr, dot11_hdr->addr2, sizeof(src_mac_addr));