* [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key
@ 2026-04-06 22:50 Feng Ning
2026-04-13 14:31 ` Luka Gejak
0 siblings, 1 reply; 6+ messages in thread
From: Feng Ning @ 2026-04-06 22:50 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel
[-- Attachment #1.1: Type: text/plain, Size: 1619 bytes --]
From: Feng Ning <feng@innora.ai>
To: gregkh@linuxfoundation.org
Cc: linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key
The cfg80211 framework allows key sequence counters (NL80211_KEY_SEQ)
up to 16 bytes, but ieee_param.crypt.seq is a fixed 8-byte buffer.
When cfg80211_rtw_add_key() copies the sequence counter via memcpy()
without checking seq_len, a heap buffer overflow of up to 8 bytes
occurs, overwriting adjacent fields key_len and key[].
Cap the copy length at the buffer size using min_t().
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Signed-off-by: Feng Ning <feng@innora.ai>
---
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 7cb0c6f22..4fba53c2d 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -883,8 +883,11 @@ static int cfg80211_rtw_add_key(struct wiphy *wiphy, struct net_device *ndev,
param->u.crypt.idx = key_index;
- if (params->seq_len && params->seq)
- memcpy(param->u.crypt.seq, (u8 *)params->seq, params->seq_len);
+ if (params->seq_len && params->seq) {
+ size_t seq_copy = min_t(size_t, params->seq_len,
+ sizeof(param->u.crypt.seq));
+ memcpy(param->u.crypt.seq, (u8 *)params->seq, seq_copy);
+ }
if (params->key_len && params->key) {
param->u.crypt.key_len = params->key_len;
--
2.43.0
[-- Attachment #1.2: publickey - Jiqiang Feng - 0x7D1A285E.asc --]
[-- Type: application/pgp-keys, Size: 693 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 322 bytes --]
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key
@ 2026-04-08 20:46 kernel test robot
0 siblings, 0 replies; 6+ messages in thread
From: kernel test robot @ 2026-04-08 20:46 UTC (permalink / raw)
To: oe-kbuild
::::::
:::::: Manual check reason: "high confidence checkpatch report"
::::::
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <adQ4yU-Pc0uHXtb5@ans-MacBook-Pro.local>
References: <adQ4yU-Pc0uHXtb5@ans-MacBook-Pro.local>
TO: Feng Ning <feng@innora.ai>
TO: gregkh@linuxfoundation.org
Hi Feng,
kernel test robot noticed the following build warnings:
[auto build test WARNING on staging/staging-testing]
url: https://github.com/intel-lab-lkp/linux/commits/Feng-Ning/staging-rtl8723bs-fix-heap-buffer-overflow-in-cfg80211_rtw_add_key/20260408-172928
base: staging/staging-testing
patch link: https://lore.kernel.org/r/adQ4yU-Pc0uHXtb5%40ans-MacBook-Pro.local
patch subject: [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key
:::::: branch date: 11 hours ago
:::::: commit date: 11 hours ago
reproduce: (https://download.01.org/0day-ci/archive/20260408/202604082249.CcWXI0B7-lkp@intel.com/reproduce)
# many are suggestions rather than must-fix
WARNING:BAD_SIGN_OFF: Unexpected content after email: 'linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org', should be: 'linux-staging@lists.linux.dev (linux-kernel@vger.kernel.org)'
#13:
Cc: linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key
@ 2026-04-13 11:32 Feng Ning
2026-04-26 19:37 ` Greg KH
0 siblings, 1 reply; 6+ messages in thread
From: Feng Ning @ 2026-04-13 11:32 UTC (permalink / raw)
To: linux-staging; +Cc: gregkh, luka.perkov, Feng Ning
The cfg80211 framework allows key sequence counters (NL80211_KEY_SEQ)
up to 16 bytes, but ieee_param.crypt.seq is a fixed 8-byte buffer.
When cfg80211_rtw_add_key() copies the sequence counter via memcpy()
without checking seq_len, a heap buffer overflow of up to 8 bytes
occurs, overwriting adjacent fields key_len and key[].
Cap the copy length at the buffer size using min_t().
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Signed-off-by: Feng Ning <feng@innora.ai>
---
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 7cb0c6f22..4fba53c2d 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -883,8 +883,11 @@ static int cfg80211_rtw_add_key(struct wiphy *wiphy, struct net_device *ndev,
param->u.crypt.idx = key_index;
- if (params->seq_len && params->seq)
- memcpy(param->u.crypt.seq, (u8 *)params->seq, params->seq_len);
+ if (params->seq_len && params->seq) {
+ size_t seq_copy = min_t(size_t, params->seq_len,
+ sizeof(param->u.crypt.seq));
+ memcpy(param->u.crypt.seq, (u8 *)params->seq, seq_copy);
+ }
if (params->key_len && params->key) {
param->u.crypt.key_len = params->key_len;
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key
2026-04-06 22:50 [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key Feng Ning
@ 2026-04-13 14:31 ` Luka Gejak
2026-04-14 6:56 ` Feng Ning
0 siblings, 1 reply; 6+ messages in thread
From: Luka Gejak @ 2026-04-13 14:31 UTC (permalink / raw)
To: Feng Ning, gregkh; +Cc: linux-staging, linux-kernel
On Tue Apr 7, 2026 at 12:50 AM CEST, Feng Ning wrote:
> From: Feng Ning <feng@innora.ai>
> To: gregkh@linuxfoundation.org
> Cc: linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org
> Subject: [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key
>
> The cfg80211 framework allows key sequence counters (NL80211_KEY_SEQ)
> up to 16 bytes, but ieee_param.crypt.seq is a fixed 8-byte buffer.
> When cfg80211_rtw_add_key() copies the sequence counter via memcpy()
> without checking seq_len, a heap buffer overflow of up to 8 bytes
> occurs, overwriting adjacent fields key_len and key[].
>
> Cap the copy length at the buffer size using min_t().
>
> Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> Signed-off-by: Feng Ning <feng@innora.ai>
> ---
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
> index 7cb0c6f22..4fba53c2d 100644
> --- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
> +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
> @@ -883,8 +883,11 @@ static int cfg80211_rtw_add_key(struct wiphy *wiphy, struct net_device *ndev,
>
> param->u.crypt.idx = key_index;
>
> - if (params->seq_len && params->seq)
> - memcpy(param->u.crypt.seq, (u8 *)params->seq, params->seq_len);
> + if (params->seq_len && params->seq) {
> + size_t seq_copy = min_t(size_t, params->seq_len,
> + sizeof(param->u.crypt.seq));
> + memcpy(param->u.crypt.seq, (u8 *)params->seq, seq_copy);
> + }
>
> if (params->key_len && params->key) {
> param->u.crypt.key_len = params->key_len;
Hi Feng,
one quick question, why did you send same patch as before? If it is
because it hasn't been merged yet please wait because it is currently
merge window and we are not accepting any new patches. We will come to
your patch eventually, just be patient.
Best regards,
Luka Gejak
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key
2026-04-13 14:31 ` Luka Gejak
@ 2026-04-14 6:56 ` Feng Ning
0 siblings, 0 replies; 6+ messages in thread
From: Feng Ning @ 2026-04-14 6:56 UTC (permalink / raw)
To: luka.gejak; +Cc: gregkh, linux-staging, linux-kernel
Hi Luka,
Thank you for the clarification. I apologize for the duplicate submission — it was sent in error. I understand that the patch is already in the queue and will wait for the merge window to close before any further action.
Best regards,
Feng Ning
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key
2026-04-13 11:32 Feng Ning
@ 2026-04-26 19:37 ` Greg KH
0 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2026-04-26 19:37 UTC (permalink / raw)
To: Feng Ning; +Cc: linux-staging, luka.perkov
On Mon, Apr 13, 2026 at 11:32:30AM +0000, Feng Ning wrote:
> The cfg80211 framework allows key sequence counters (NL80211_KEY_SEQ)
> up to 16 bytes, but ieee_param.crypt.seq is a fixed 8-byte buffer.
> When cfg80211_rtw_add_key() copies the sequence counter via memcpy()
> without checking seq_len, a heap buffer overflow of up to 8 bytes
> occurs, overwriting adjacent fields key_len and key[].
>
> Cap the copy length at the buffer size using min_t().
>
> Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> Signed-off-by: Feng Ning <feng@innora.ai>
> ---
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
> index 7cb0c6f22..4fba53c2d 100644
> --- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
> +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
> @@ -883,8 +883,11 @@ static int cfg80211_rtw_add_key(struct wiphy *wiphy, struct net_device *ndev,
>
> param->u.crypt.idx = key_index;
>
> - if (params->seq_len && params->seq)
> - memcpy(param->u.crypt.seq, (u8 *)params->seq, params->seq_len);
> + if (params->seq_len && params->seq) {
> + size_t seq_copy = min_t(size_t, params->seq_len,
> + sizeof(param->u.crypt.seq));
> + memcpy(param->u.crypt.seq, (u8 *)params->seq, seq_copy);
> + }
>
> if (params->key_len && params->key) {
> param->u.crypt.key_len = params->key_len;
> --
> 2.43.0
>
>
>
This really is v5, right? What happened to the changelog information?
Please fix up and send a v6.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-04-27 3:50 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-06 22:50 [PATCH] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key Feng Ning
2026-04-13 14:31 ` Luka Gejak
2026-04-14 6:56 ` Feng Ning
-- strict thread matches above, loose matches on Subject: below --
2026-04-08 20:46 kernel test robot
2026-04-13 11:32 Feng Ning
2026-04-26 19:37 ` Greg KH
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.