All of lore.kernel.org
 help / color / mirror / Atom feed
* FAILED: patch "[PATCH] staging: rtl8723bs: fix WEP length underflow and OOB read in" failed to apply to 5.10-stable tree
@ 2026-07-13 13:32 gregkh
  2026-07-14 23:34 ` [PATCH 5.10.y 1/8] staging: rtl8723bs: split too long line Sasha Levin
  0 siblings, 1 reply; 9+ messages in thread
From: gregkh @ 2026-07-13 13:32 UTC (permalink / raw)
  To: hossu.alexandru, gregkh, stable; +Cc: stable


The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x a1fc19d61f661d47204f095b593de507884849f7
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026071352-wreckage-humorless-3481@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From a1fc19d61f661d47204f095b593de507884849f7 Mon Sep 17 00:00:00 2001
From: Alexandru Hossu <hossu.alexandru@gmail.com>
Date: Fri, 22 May 2026 02:46:05 +0200
Subject: [PATCH] staging: rtl8723bs: fix WEP length underflow and OOB read in
 OnAuth()

OnAuth() has two bugs in the shared-key authentication path.

When the Privacy bit is set, rtw_wep_decrypt() is called without
verifying that the frame is long enough to contain a valid WEP IV and
ICV.  Inside rtw_wep_decrypt(), length is computed as:

    length = len - WLAN_HDR_A3_LEN - iv_len

and then passed as (length - 4) to crc32_le().  If len is less than
WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative
and, after the implicit cast to size_t, causes crc32_le() to read far
beyond the frame buffer.  Add a minimum length check before accessing
the IV field and calling the decryption path.

When processing a seq=3 response, rtw_get_ie() stores the Challenge
Text IE length in ie_len, but the subsequent memcmp() always reads 128
bytes regardless of ie_len.  IEEE 802.11 mandates a challenge text of
exactly 128 bytes; reject any IE whose length field differs, matching
the check already applied to OnAuthClient().

Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004605.1039209-1-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
index a86d6f97cf02..7198be795000 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -677,6 +677,9 @@ unsigned int OnAuth(struct adapter *padapter, union recv_frame *precv_frame)
 	if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
 		return _FAIL;
 
+	if (len < WLAN_HDR_A3_LEN)
+		return _FAIL;
+
 	sa = GetAddr2Ptr(pframe);
 
 	auth_mode = psecuritypriv->dot11AuthAlgrthm;
@@ -688,6 +691,9 @@ unsigned int OnAuth(struct adapter *padapter, union recv_frame *precv_frame)
 		prxattrib->hdrlen = WLAN_HDR_A3_LEN;
 		prxattrib->encrypt = _WEP40_;
 
+		if (len < WLAN_HDR_A3_LEN + 8)
+			return _FAIL;
+
 		iv = pframe+prxattrib->hdrlen;
 		prxattrib->key_index = ((iv[3]>>6)&0x3);
 
@@ -787,7 +793,7 @@ unsigned int OnAuth(struct adapter *padapter, union recv_frame *precv_frame)
 			p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&ie_len,
 					len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
 
-			if (!p || ie_len <= 0) {
+			if (!p || ie_len != 128) {
 				status = WLAN_STATUS_CHALLENGE_FAIL;
 				goto auth_fail;
 			}


^ permalink raw reply related	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-07-14 23:34 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-13 13:32 FAILED: patch "[PATCH] staging: rtl8723bs: fix WEP length underflow and OOB read in" failed to apply to 5.10-stable tree gregkh
2026-07-14 23:34 ` [PATCH 5.10.y 1/8] staging: rtl8723bs: split too long line Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 2/8] staging: rtl8723bs: remove commented out RT_ASSERT occurrences Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 3/8] staging: rtl8723bs: remove all 5Ghz network types Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 4/8] staging: rtl8723bs: remove 5Ghz code related to channel plan definition Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 5/8] staging: rtl8723bs: remove 5Ghz code blocks Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 6/8] staging: rtl8723bs: remove commented out condition Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 7/8] staging: rtl8723bs: clean up comparsions to NULL Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 8/8] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Sasha Levin

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.