v7, addressing the sashiko review comments on v6.
Regarding hardware: I do not have rtl8723bs hardware available. The
patches in this series are derived from static analysis of the code,
cross-checking against the 802.11 spec, and reviewing the patterns
already in use elsewhere in the same driver.
This series fixes authentication frame handling in the rtl8723bs driver.
Patch 1/2 fixes heap overflows in the Challenge Text IE paths of both
OnAuthClient() (STA mode) and OnAuth() (AP mode): the IE length field
from the received frame was used without checking it equals 128, the
fixed size mandated by IEEE 802.11.
Patch 2/2 adds frame length guards before the first direct pframe
dereferences in both OnAuth() and OnAuthClient(). Without these checks,
a frame shorter than WLAN_HDR_A3_LEN bytes causes out-of-bounds reads
before any IE parsing even begins. Two additional guards cover the
algorithm/sequence fields in OnAuth() and the seq/status fields in
OnAuthClient(), which are read at variable offsets past the 802.11 header.
OnAssocRsp() was already fixed in a separate series.
What changed in v7:
Patch 1/2:
- No code changes from v6; dropping Reviewed-by: Dan Carpenter because
patch 2/2 changes code from the reviewed version.
Patch 2/2:
- Add frame length checks for OnAuth(): guard before GetAddr2Ptr
(len < WLAN_HDR_A3_LEN) and guard before algorithm/seq reads
(len < WLAN_HDR_A3_LEN + offset + 4).
- Correct commit message: remove incorrect claim that rtw_get_ie()
unsigned underflow causes OOB scan; rtw_get_ie() uses signed int
limit and returns NULL immediately when limit < 2, so the wrapped
value is caught before any scan occurs.
Alexandru Hossu (2):
staging: rtl8723bs: fix Challenge Text IE length checks in
OnAuthClient() and OnAuth()
staging: rtl8723bs: fix missing frame length checks in OnAuth() and
OnAuthClient()
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--
2.53.0