Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Staging driver fixes for 7.1-final

Browse source 
Here are two small bugfixes for a staging driver to fix a
 much-reported issue.  The fixes are for the rtl8723bs driver and it's
 something that many scanning tools keep tripping over in convoluted ways
 (and seems to be able to be triggered by network traffic.)  These fixes
 have been in linux-next for many weeks with no reported issues, sorry
 for the delay in getting them to you.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaivZug8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ykZ3gCfYVW4wCYm4ZpkkYly3bO75AMaFmIAoMfIB0qD
 tUDe4wHd9gPN2JYTJfxf
 =zdW9
 -----END PGP SIGNATURE-----

Merge tag 'staging-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver fixes from Greg KH:
 "Here are two small bugfixes for a staging driver to fix a
  much-reported issue.

  The fixes are for the rtl8723bs driver and it's something that many
  scanning tools keep tripping over in convoluted ways (and seems to be
  able to be triggered by network traffic)

  These fixes have been in linux-next for many weeks with no reported
  issues, sorry for the delay in getting them to you"

* tag 'staging-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
  staging: rtl8723bs: fix buffer over-read in rtw_update_protection
This commit is contained in:
Linus Torvalds 2026-06-12 10:10:12 -07:00
commit c133f0433a
1 changed files with 18 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

24
drivers/staging/rtl8723bs/core/rtw_mlme.c
View file

@ -464,8 +464,11 @@ static void update_current_network(struct adapter *adapter, struct wlan_bssid_ex
if (check_fwstate(pmlmepriv, _FW_LINKED) && (is_same_network(&pmlmepriv->cur_network.network, pnetwork, 0))) {
update_network(&pmlmepriv->cur_network.network, pnetwork, adapter, true);
if (pmlmepriv->cur_network.network.ie_length < sizeof(struct ndis_802_11_fix_ie))
return;
rtw_update_protection(adapter, (pmlmepriv->cur_network.network.ies) + sizeof(struct ndis_802_11_fix_ie),
pmlmepriv->cur_network.network.ie_length);
pmlmepriv->cur_network.network.ie_length - sizeof(struct ndis_802_11_fix_ie));
}
}
@ -601,6 +604,8 @@ static bool rtw_is_desired_network(struct adapter *adapter, struct wlan_network
privacy = pnetwork->network.privacy;
if (check_fwstate(pmlmepriv, WIFI_UNDER_WPS)) {
if (pnetwork->network.ie_length < _FIXED_IE_LENGTH_)
return false;
if (rtw_get_wps_ie(pnetwork->network.ies + _FIXED_IE_LENGTH_, pnetwork->network.ie_length - _FIXED_IE_LENGTH_, NULL, &wps_ielen))
return true;
else
@ -614,11 +619,15 @@ static bool rtw_is_desired_network(struct adapter *adapter, struct wlan_network
bselected = false;
if (psecuritypriv->ndisauthtype == Ndis802_11AuthModeWPA2PSK) {
p = rtw_get_ie(pnetwork->network.ies + _BEACON_IE_OFFSET_, WLAN_EID_RSN, &ie_len, (pnetwork->network.ie_length - _BEACON_IE_OFFSET_));
if (p && ie_len > 0)
bselected = true;
else
if (pnetwork->network.ie_length < _BEACON_IE_OFFSET_) {
bselected = false;
} else {
p = rtw_get_ie(pnetwork->network.ies + _BEACON_IE_OFFSET_, WLAN_EID_RSN, &ie_len, (pnetwork->network.ie_length - _BEACON_IE_OFFSET_));
if (p && ie_len > 0)
bselected = true;
else
bselected = false;
}
}
}
@ -1072,8 +1081,11 @@ static void rtw_joinbss_update_network(struct adapter *padapter, struct wlan_net
break;
}
if (cur_network->network.ie_length < sizeof(struct ndis_802_11_fix_ie))
return;
rtw_update_protection(padapter, (cur_network->network.ies) + sizeof(struct ndis_802_11_fix_ie),
(cur_network->network.ie_length));
(cur_network->network.ie_length - sizeof(struct ndis_802_11_fix_ie)));
rtw_update_ht_cap(padapter, cur_network->network.ies, cur_network->network.ie_length, (u8) cur_network->network.configuration.ds_config);
}