From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=79.135.106.25 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793801077; b=5bpiyrTxxZvo5KqXoX+UaA+8wVNy7ks0haKnLu+QDqci0QhVr6c5iiQ5gaFU+K7WIcZI cTYbK4MY0jVZGdXjR8wupcc7hlyygfBz6Xk1+MqPsymkUK18wgh2pd49jPkKpPhE6eIqO ZPrCSvav/H4lLrfUydPh5jCJev6BEaX8pLXK9G+A+LNd56A3dBzz7dFhZ4g+JJo0h1D9e G79+sbpFSUPhPWm0nL9dyPbQVTq65tF/oMXVEH8S8tP0H0G9qRjAjCOBMubyuPAju0Wop 5t0iWVKvI6ob3+jAl+KC4pXe+BAdjcb2kE84VgZ2KunYnMYAcOGF1GZ+QqQd6jKfV2Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793801077; h=DMARC-Filter:DKIM-Signature:Date:To:From:Cc:Subject:Message-ID: In-Reply-To:References:Feedback-ID:X-Pm-Message-ID:MIME-Version: Content-Type:Content-Transfer-Encoding; bh=Q+j0w6ajOyPB3jD/rih0h/NMdkOlRGOguGnwdiyJXsw=; b=LXOkPo8bME4WrkGkeg5CMMMB3DdYU0Bizej+9IirkbC5NH/j0uMJbFHMU7wLqeM0++Gi zIbjKIid71C91aiwXzi4iZRI7I5cruAMF3cVATMdL0LKdWiaffyImTgJpNjYUqYD/fuUn bbJWo31AI7qm+Vav2wk4sL7jwTr7ANgHkY92utKAmVUAs15yW4NgxTrHHqbFkWAAm2C68 6zelp/K75M2iJ2JFOcJKfE37D8wK4QyZuH+xWo6aOtICjdNeLXtZfWj1yt1Z+tMnYOq1S UaBDYUWzglv/4PjdOPdnoiTJAi7HYT28CgXzdbd8jalf5MZYsbEXdMZQu4tU7F7JPpA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=innora.ai; spf=pass smtp.mailfrom=innora.ai; arc=none smtp.remote-ip=79.135.106.25 Received: from mail-10625.protonmail.ch (mail-10625.protonmail.ch [79.135.106.25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BDEA3606A328 for ; Wed, 4 Nov 2026 14:04:35 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org BDEA3606A328 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=innora.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=innora.ai DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=innora.ai; s=protonmail3; t=1793801073; x=1794060273; bh=Q+j0w6ajOyPB3jD/rih0h/NMdkOlRGOguGnwdiyJXsw=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector; b=lpViz+t9kVbQWUd5rZldLkKtBKd1ACpQazUWDmKWA3Hueteye7bIvZZfMVDyVSscy tW79nEn1lzxTkYtyUGTzNw08dDS37qtMRyMJQJAVJESMzPYaeZv+5V73FDOlh1wOEd fJwk6WxjefHXbgTJ3mEwX2Mf7m3TP7ao6FM9WZZgOGIKek5FZv/PuMKtjYVkooY+Po KVd2KdQOZS3l3jc2aeUTcNaZoOlF16HJwqIH2QJnRXMO1OQivBkjJlcJYWPXkjGUk6 DT0KMgpczJNklTY539bRQKsQsmBeL7PkjKAvIF4gabQRfOdJBSdJvMKFyUo9w4rrYH ZZHaBr3cuKaFg== Date: Wed, 04 Nov 2026 14:04:29 +0000 To: gregkh@linuxfoundation.org From: Feng Ning Cc: linux-staging@lists.linux.dev, linux-wireless@vger.kernel.org, luka.gejak@linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Feng Ning Subject: [RFC PATCH v7] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key() Message-ID: <20261104220347.ccc09fa4-1-feng@innora.ai> In-Reply-To: <2026050458-numbness-haven-1ae4@gregkh> References: <20260413113224.5201-1-feng@innora.ai> <2026042626-tabloid-suitor-33c5@gregkh> <20260427111738.33069-1-feng@innora.ai> <2026050417-monkhood-backless-4c3e@gregkh> <20260504154823.52057-1-feng@innora.ai> <2026050458-numbness-haven-1ae4@gregkh> Feedback-ID: 140578448:user:proton X-Pm-Message-ID: b23681433844d943cff66205ae382c2b33bbff42 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable The cfg80211 framework allows userspace to specify a key sequence counter (NL80211_KEY_SEQ) of up to 16 bytes via NL80211_CMD_NEW_KEY netlink messages, but ieee_param.crypt.seq is a fixed 8-byte buffer. When cfg80211_rtw_add_key() copies the sequence counter via memcpy() without checking seq_len, a heap buffer overflow of up to 8 bytes occurs, overwriting bytes following seq within the same ieee_param structure (key_len and the trailing key[] flexible array). Reject sequence counters longer than the destination buffer with -EINVAL instead of copying them, as discussed during review of v6. This is sent as an RFC because it still lacks a Tested-by from real hardware. A userspace trigger program for the overflow (libnl-based, NL80211_CMD_NEW_KEY with a 16-byte NL80211_ATTR_KEY_SEQ) follows in a reply to this thread; anyone with an rtl8723bs device who can run it against this patch would help unblock the fix. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Feng Ning --- Changes v6 -> v7: - Replace silent min_t() truncation with an explicit -EINVAL when seq_len exceeds sizeof(param->u.crypt.seq), per review feedback (Greg KH, Sashiko automated review) - Use the existing addkey_end cleanup path so param is freed on the new error return - Sent as RFC: code is complete but awaits a Tested-by from real rtl8723bs hardware Changes v5 -> v6: - Restore the changelog that was lost in v5 (per Greg KH feedback) - Add Cc: stable@vger.kernel.org (user-reachable heap overflow) - No code changes from v5 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/st= aging/rtl8723bs/os_dep/ioctl_cfg80211.c index 7cb0c6f22..000000000 100644 --- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c @@ -896,8 +896,10 @@ static int cfg80211_rtw_add_key(struct wiphy *wiphy, s= truct net_device *ndev, =09param->u.crypt.idx =3D key_index; -=09if (params->seq_len && params->seq) -=09=09memcpy(param->u.crypt.seq, (u8 *)params->seq, params->seq_len); +=09if (params->seq_len > sizeof(param->u.crypt.seq)) { +=09=09ret =3D -EINVAL; +=09=09goto addkey_end; +=09} + +=09if (params->seq_len && params->seq) +=09=09memcpy(param->u.crypt.seq, (u8 *)params->seq, params->seq_len); =09if (params->key_len && params->key) { =09=09param->u.crypt.key_len =3D params->key_len; -- 2.43.0