blob: 9d27c078278e3f2f60027c3afe48deaf8a80d36f [file] [log] [blame]
From 418b93564df16ea15ce7dfd045d420543c48951e Mon Sep 17 00:00:00 2001
From: Larry Finger <>
Date: Mon, 10 Feb 2020 12:02:33 -0600
Subject: [PATCH] staging: rtl8723bs: Fix potential overuse of kernel memory
commit 23954cb078febfc63a755301fe77e06bccdb4d2a upstream.
In routine wpa_supplicant_ioctl(), the user-controlled p->length is
checked to be at least the size of struct ieee_param size, but the code
does not detect the case where p->length is greater than the size
of the struct, thus a malicious user could be wasting kernel memory.
Fixes commit 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver").
Reported by: Pietro Oliva <>
Cc: Pietro Oliva <>
Cc: Stable <>
Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver").
Signed-off-by: Larry Finger <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Paul Gortmaker <>
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
index 284abcd11e62..5dea816351d1 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -3396,7 +3396,7 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
/* down(&ieee->wx_sem); */
- if (p->length < sizeof(struct ieee_param) || !p->pointer) {
+ if (!p->pointer || p->length != sizeof(struct ieee_param)) {
ret = -EINVAL;
goto out;