diff options
| author | Tianchu Chen <flynnnchen@tencent.com> | 2026-09-11 11:10:42 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-10-01 07:44:59 +0200 |
| commit | c52929073fccbc149267a2fd7458626a7e9abcfc (patch) | |
| tree | df3f641b0fc199c72901395704c0da970d0ee3a9 /tools/lib/python | |
| parent | 46137a1e0f89acca72b46546c9c8aae75bb940c3 (diff) | |
staging: rtl8723bs: fix RX buffer OOB write from device-reported length
sd_recv_rxfifo() trusts the device-reported RX0_REQ_LEN value
(hal->SdioRxFIFOSize, a u16 read from the card via CMD52) as the
size of the next RX packet and passes it to sdio_read_port(), which
copies that many bytes into the recvbuf skb whose data area is only
MAX_RECVBUF_SZ (10240) bytes. A bogus device on SDIO can report up to
65535 bytes, causing a heap overflow of up to ~55KB past the skb
buffer.
Bail out when the RX0_REQ_LEN exceeds MAX_RECVBUF_SZ. This is expected
to keep behavior unchanged on normal devices.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Link: https://patch.msgid.link/8114c3adc1acaea78523cc0fb4d4b25f7665cee9@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions