staging: rtl8723bs: Fix potential overuse of kernel memory

In routine wpa_supplicant_ioctl(), the user-controlled p->length is
checked to be at least the size of struct ieee_param size, but the code
does not detect the case where p->length is greater than the size
of the struct, thus a malicious user could be wasting kernel memory.
Fixes commit 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver").

Reported by: Pietro Oliva <[email protected]>
Cc: Pietro Oliva <[email protected]>
Cc: Stable <[email protected]>
Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver").
Signed-off-by: Larry Finger <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
index 3128766dd50e64200790a65d690a34531a12cc58..2ac0d84f090e01c3cebdc1f9132de153034d8364 100644 (file)
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -3373,7 +3373,7 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
 
        /* down(&ieee->wx_sem); */
 
 
        /* down(&ieee->wx_sem); */
 

-       if (p->length < sizeof(struct ieee_param) || !p->pointer) {
+       if (!p->pointer || p->length != sizeof(struct ieee_param)) {

                ret = -EINVAL;
                goto out;
        }
                ret = -EINVAL;
                goto out;
        }