[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <Yl/7QPKXer7YtXOs@bertie>
Date: Wed, 20 Apr 2022 07:23:28 -0500
From: Rebecca Mckeever <remckee0@...il.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org,
outreachy@...ts.linux.dev
Subject: [PATCH] staging: rtl8192u: change get_key functions to return 0
instead of -1
Currently, these three get_key functions return -1 when the provided len
value is less a specific key length value, which can result in buffer
overflow depending on how the returned value is used. These functions are
used in three places in ieee80211/ieee80211_wx.c:
ieee80211_wx_get_encode() :
The behavior of this function will be unchanged.
ieee80211_wx_get_encode_ext() :
The result of the get_key function is written to ext->key_len,
resulting in a buffer overflow if the result is negative.
ieee80211_wx_set_encode() :
The behavior of this function will change. When len is less than the
key length value, it will set a default key of all 0.
Suggested-by: Dan Carpenter <dan.carpenter@...cle.com>
Signed-off-by: Rebecca Mckeever <remckee0@...il.com>
---
drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c | 2 +-
drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c | 2 +-
drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c
index 101c28265e91..f17d07dad56d 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c
@@ -362,7 +362,7 @@ static int ieee80211_ccmp_get_key(void *key, int len, u8 *seq, void *priv)
struct ieee80211_ccmp_data *data = priv;
if (len < CCMP_TK_LEN)
- return -1;
+ return 0;
if (!data->key_set)
return 0;
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c
index 689d8843f538..7b120b8cb982 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c
@@ -637,7 +637,7 @@ static int ieee80211_tkip_get_key(void *key, int len, u8 *seq, void *priv)
struct ieee80211_tkip_data *tkey = priv;
if (len < TKIP_KEY_LEN)
- return -1;
+ return 0;
if (!tkey->key_set)
return 0;
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c
index 8a51ea1dd6e5..a2cdf3bfd1a4 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c
@@ -201,7 +201,7 @@ static int prism2_wep_get_key(void *key, int len, u8 *seq, void *priv)
struct prism2_wep_data *wep = priv;
if (len < wep->key_len)
- return -1;
+ return 0;
memcpy(key, wep->key, wep->key_len);
--
2.32.0
Powered by blists - more mailing lists