From: Rebecca Mckeever Date: Wed, 20 Apr 2022 12:23:28 +0000 (-0500) Subject: staging: rtl8192u: change get_key functions to return 0 instead of -1 X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=17c8129e06241b635c7945d109eec498301628d3;p=linux.git staging: rtl8192u: change get_key functions to return 0 instead of -1 Currently, these three get_key functions return -1 when the provided len value is less a specific key length value, which can result in buffer overflow depending on how the returned value is used. These functions are used in three places in ieee80211/ieee80211_wx.c: ieee80211_wx_get_encode() : The behavior of this function will be unchanged. ieee80211_wx_get_encode_ext() : The result of the get_key function is written to ext->key_len, resulting in a buffer overflow if the result is negative. ieee80211_wx_set_encode() : The behavior of this function will change. When len is less than the key length value, it will set a default key of all 0. Suggested-by: Dan Carpenter Signed-off-by: Rebecca Mckeever Link: https://lore.kernel.org/r/Yl/7QPKXer7YtXOs@bertie Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c index 101c28265e913..f17d07dad56d1 100644 --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c @@ -362,7 +362,7 @@ static int ieee80211_ccmp_get_key(void *key, int len, u8 *seq, void *priv) struct ieee80211_ccmp_data *data = priv; if (len < CCMP_TK_LEN) - return -1; + return 0; if (!data->key_set) return 0; diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c index 689d8843f538d..7b120b8cb9824 100644 --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c @@ -637,7 +637,7 @@ static int ieee80211_tkip_get_key(void *key, int len, u8 *seq, void *priv) struct ieee80211_tkip_data *tkey = priv; if (len < TKIP_KEY_LEN) - return -1; + return 0; if (!tkey->key_set) return 0; diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c index 8a51ea1dd6e55..a2cdf3bfd1a47 100644 --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c @@ -201,7 +201,7 @@ static int prism2_wep_get_key(void *key, int len, u8 *seq, void *priv) struct prism2_wep_data *wep = priv; if (len < wep->key_len) - return -1; + return 0; memcpy(key, wep->key, wep->key_len);