projects/linux·commit e663f6de

Merge tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

e663f6de · Linus Torvalds <[email protected]> · 2026-08-08 16:29:33 -07:00

Pull staging driver fixes from Greg KH:
 "Here are some more small staging driver fixes, just for the rtl8723bs
  driver, for some reported problems found with it now that people are
  starting to actually test the thing with "bad" networks.

  Nothing major, but good to have in the -final release. All of these
  have been in linux-next for over a week with no reported problems"

* tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8723bs: validate monitor transmit frame lengths
  staging: rtl8723bs: fix missing shared-key auth challenge length check
  staging: rtl8723bs: fix OOB read in WMM_param_handler()
  staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
Commit
e663f6deac9d113d158eb0ba7433659fe4d95ade
Parents
5668ba23 · 6829665d

Merge commit. Changes below are compared with the first parent: 5668ba23.

Changes

4 files changed · +11 −1

FileStatusAddDelContent
drivers/staging/rtl8723bs/core/rtw_ieee80211.cmodified+3−0View file
drivers/staging/rtl8723bs/core/rtw_mlme_ext.cmodified+1−1View file
drivers/staging/rtl8723bs/core/rtw_wlan_util.cmodified+3−0View file
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.cmodified+4−0View file

drivers/staging/rtl8723bs/core/rtw_ieee80211.c

View file
diff --git a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
index 863ddf8..e60ed33 100644
--- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@ -371,6 +371,9 @@ unsigned char *rtw_get_wpa_ie(unsigned char *pie, int *wpa_ie_len, int limit)
pbuf = rtw_get_ie(pbuf, WLAN_EID_VENDOR_SPECIFIC, &len, limit_new);
if (pbuf) {
+ if (len < 6)
+ goto check_next_ie;
+
/* check if oui matches... */
if (memcmp((pbuf + 2), wpa_oui_type, sizeof(wpa_oui_type)))
goto check_next_ie;

drivers/staging/rtl8723bs/core/rtw_mlme_ext.c

View file
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
index a443b35..a9382dc 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -879,7 +879,7 @@ unsigned int OnAuthClient(struct adapter *padapter, union recv_frame *precv_fram
p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&len,
pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
- if (!p)
+ if (!p || len != WLAN_AUTH_CHALLENGE_LEN)
goto authclnt_fail;
memcpy(pmlmeinfo->chg_txt, p + 2, len);

drivers/staging/rtl8723bs/core/rtw_wlan_util.c

View file
diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index a4de538..c614c0b 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -666,6 +666,9 @@ int WMM_param_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)
return false;
}
+ if (pIE->length != WLAN_WMM_LEN)
+ return false;
+
if (!memcmp(&(pmlmeinfo->WMM_param), (pIE->data + 6), sizeof(struct WMM_para_element)))
return false;

drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c

View file
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 967cd1b..9fa3131 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -2033,6 +2033,8 @@ static netdev_tx_t rtw_cfg80211_monitor_if_xmit_entry(struct sk_buff *skb, struc
/* Skip the ratio tap header */
skb_pull(skb, rtap_len);
+ if (skb->len < dot11_hdr_len)
+ goto fail;
dot11_hdr = (struct ieee80211_hdr *)skb->data;
frame_control = le16_to_cpu(dot11_hdr->frame_control);
@@ -2045,6 +2047,8 @@ static netdev_tx_t rtw_cfg80211_monitor_if_xmit_entry(struct sk_buff *skb, struc
qos_len = 2;
if ((frame_control & 0x0300) == 0x0300)
dot11_hdr_len += 6;
+ if (skb->len < dot11_hdr_len + qos_len + snap_len)
+ goto fail;
memcpy(dst_mac_addr, dot11_hdr->addr1, sizeof(dst_mac_addr));
memcpy(src_mac_addr, dot11_hdr->addr2, sizeof(src_mac_addr));