From: Greg KH <gregkh@linuxfoundation.org>
To: Larry Finger <Larry.Finger@lwfinger.net>
Cc: netdev@vger.kernel.org, devel@driverdev.osuosl.org,
Pietro Oliva <pietroliva@gmail.com>,
Stable <stable@vger.kernel.org>
Subject: Re: [PATCH 4/6] staging: rtl8723bs: Fix potential overuse of kernel memory
Date: Mon, 10 Feb 2020 10:27:55 -0800 [thread overview]
Message-ID: <20200210182755.GA1048334@kroah.com> (raw)
In-Reply-To: <20200210180235.21691-5-Larry.Finger@lwfinger.net>
On Mon, Feb 10, 2020 at 12:02:33PM -0600, Larry Finger wrote:
> In routine wpa_supplicant_ioctl(), the user-controlled p->length is
> checked to be at least the size of struct ieee_param size, but the code
> does not detect the case where p->length is greater than the size
> of the struct, thus a malicious user could be wasting kernel memory.
> Fixes commit 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver").
>
> Reported by: Pietro Oliva <pietroliva@gmail.com>
> Cc: Pietro Oliva <pietroliva@gmail.com>
> Cc: Stable <stable@vger.kernel.org>
> Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver").
> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
> -# Please enter the commit message for your changes. Lines starting
> ---
Funny line :)
I'll go edit it...
thanks,
greg k-h
next prev parent reply other threads:[~2020-02-10 18:27 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-10 18:02 [PATCH 0/6] staging: rtl8188eu and rtl8723bs - some fixes and cleanups Larry Finger
2020-02-10 18:02 ` [PATCH 1/6] staging: rtl8188eu: Fix potential security hole Larry Finger
2020-02-10 18:02 ` [PATCH 2/6] staging: rtl8723bs: " Larry Finger
2020-02-10 18:02 ` [PATCH 3/6] staging: rtl8188eu: Fix potential overuse of kernel memory Larry Finger
2020-02-10 18:02 ` [PATCH 4/6] staging: rtl8723bs: " Larry Finger
2020-02-10 18:27 ` Greg KH [this message]
2020-02-10 18:02 ` [PATCH 5/6] staging: rtl8188eu: Remove some unneeded goto statements Larry Finger
2020-02-10 18:02 ` [PATCH 6/6] staging: rtl8723bs: Remove " Larry Finger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200210182755.GA1048334@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=Larry.Finger@lwfinger.net \
--cc=devel@driverdev.osuosl.org \
--cc=netdev@vger.kernel.org \
--cc=pietroliva@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).