staging: rtl8192u: change get_key functions to return 0 instead of -1
authorRebecca Mckeever <remckee0@gmail.com>
Wed, 20 Apr 2022 12:23:28 +0000 (07:23 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 22 Apr 2022 14:41:28 +0000 (16:41 +0200)
commit17c8129e06241b635c7945d109eec498301628d3
tree66cbf6d42d19c2665a1b8b4cf31f4cd3e3e19483
parent55de6cb7f81c82dea1bdb12cd3818280af7abd87
staging: rtl8192u: change get_key functions to return 0 instead of -1

Currently, these three get_key functions return -1 when the provided len
value is less a specific key length value, which can result in buffer
overflow depending on how the returned value is used. These functions are
used in three places in ieee80211/ieee80211_wx.c:

  ieee80211_wx_get_encode() :
    The behavior of this function will be unchanged.

  ieee80211_wx_get_encode_ext() :
    The result of the get_key function is written to ext->key_len,
    resulting in a buffer overflow if the result is negative.

  ieee80211_wx_set_encode() :
    The behavior of this function will change. When len is less than the
    key length value, it will set a default key of all 0.

Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rebecca Mckeever <remckee0@gmail.com>
Link: https://lore.kernel.org/r/Yl/7QPKXer7YtXOs@bertie
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c
drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c
drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c