stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* FAILED: patch "[PATCH] staging: rtl8723bs: fix WEP length underflow and OOB read in" failed to apply to 5.10-stable tree
@ 2026-07-13 13:32 gregkh
  2026-07-14 23:34 ` [PATCH 5.10.y 1/8] staging: rtl8723bs: split too long line Sasha Levin
  0 siblings, 1 reply; 9+ messages in thread
From: gregkh @ 2026-07-13 13:32 UTC (permalink / raw)
  To: hossu.alexandru, gregkh, stable; +Cc: stable


The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x a1fc19d61f661d47204f095b593de507884849f7
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026071352-wreckage-humorless-3481@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From a1fc19d61f661d47204f095b593de507884849f7 Mon Sep 17 00:00:00 2001
From: Alexandru Hossu <hossu.alexandru@gmail.com>
Date: Fri, 22 May 2026 02:46:05 +0200
Subject: [PATCH] staging: rtl8723bs: fix WEP length underflow and OOB read in
 OnAuth()

OnAuth() has two bugs in the shared-key authentication path.

When the Privacy bit is set, rtw_wep_decrypt() is called without
verifying that the frame is long enough to contain a valid WEP IV and
ICV.  Inside rtw_wep_decrypt(), length is computed as:

    length = len - WLAN_HDR_A3_LEN - iv_len

and then passed as (length - 4) to crc32_le().  If len is less than
WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative
and, after the implicit cast to size_t, causes crc32_le() to read far
beyond the frame buffer.  Add a minimum length check before accessing
the IV field and calling the decryption path.

When processing a seq=3 response, rtw_get_ie() stores the Challenge
Text IE length in ie_len, but the subsequent memcmp() always reads 128
bytes regardless of ie_len.  IEEE 802.11 mandates a challenge text of
exactly 128 bytes; reject any IE whose length field differs, matching
the check already applied to OnAuthClient().

Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004605.1039209-1-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
index a86d6f97cf02..7198be795000 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -677,6 +677,9 @@ unsigned int OnAuth(struct adapter *padapter, union recv_frame *precv_frame)
 	if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
 		return _FAIL;
 
+	if (len < WLAN_HDR_A3_LEN)
+		return _FAIL;
+
 	sa = GetAddr2Ptr(pframe);
 
 	auth_mode = psecuritypriv->dot11AuthAlgrthm;
@@ -688,6 +691,9 @@ unsigned int OnAuth(struct adapter *padapter, union recv_frame *precv_frame)
 		prxattrib->hdrlen = WLAN_HDR_A3_LEN;
 		prxattrib->encrypt = _WEP40_;
 
+		if (len < WLAN_HDR_A3_LEN + 8)
+			return _FAIL;
+
 		iv = pframe+prxattrib->hdrlen;
 		prxattrib->key_index = ((iv[3]>>6)&0x3);
 
@@ -787,7 +793,7 @@ unsigned int OnAuth(struct adapter *padapter, union recv_frame *precv_frame)
 			p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&ie_len,
 					len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
 
-			if (!p || ie_len <= 0) {
+			if (!p || ie_len != 128) {
 				status = WLAN_STATUS_CHALLENGE_FAIL;
 				goto auth_fail;
 			}


^ permalink raw reply related	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-07-14 23:34 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-13 13:32 FAILED: patch "[PATCH] staging: rtl8723bs: fix WEP length underflow and OOB read in" failed to apply to 5.10-stable tree gregkh
2026-07-14 23:34 ` [PATCH 5.10.y 1/8] staging: rtl8723bs: split too long line Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 2/8] staging: rtl8723bs: remove commented out RT_ASSERT occurrences Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 3/8] staging: rtl8723bs: remove all 5Ghz network types Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 4/8] staging: rtl8723bs: remove 5Ghz code related to channel plan definition Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 5/8] staging: rtl8723bs: remove 5Ghz code blocks Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 6/8] staging: rtl8723bs: remove commented out condition Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 7/8] staging: rtl8723bs: clean up comparsions to NULL Sasha Levin
2026-07-14 23:34   ` [PATCH 5.10.y 8/8] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).