From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2D9E39A05A for ; Mon, 27 Apr 2026 08:19:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777277979; cv=none; b=q+iIaeveQ9jQDPzO5VOrWZNY8Sr4cQC3NxXu08cyF0Kde4rdgZ3dmQ7rUfdyelEMaTmSO9pNfpHK2zipbEzdMAg2B96+863xoibdYXJWmGkzA8DKMQGQVJaFrSU2SJTERAwr8Kztf3y9jYCFP+GTqMxxc4QU0Wtp1NbrC3VWZK8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777277979; c=relaxed/simple; bh=r/Wx8N+TzSIf88QST3/R6rgVPln6hsLTHzTDpaK4xm0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ssGKAuThv7lkcBWIHesEE4Qj0jbuxFLbngpxtCiyVZi89iTnx9fHtWIjPJmiGnMAQ4RIkfoJGQ2JyYUiWz8atlpTPiyMPEyYaj5Oko4wjE3k8XEuHcS48hPYCpM4ueeiWKk2Xca89bj22qXV0/60x1AjmyLE2yErfHgSrOaN/Io= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Zt7cexzV; arc=none smtp.client-ip=209.85.221.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Zt7cexzV" Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-43d0deb7ad5so8230400f8f.2 for ; Mon, 27 Apr 2026 01:19:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777277976; x=1777882776; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=SeS7jfeq02kdIfdPZeM3Est0x/TfzAtyHosBJLLc1RM=; b=Zt7cexzVHeP2JOAbQyb9D8WlhimispIEl9Q+telP1I4Ci0VIGnGfNVw1tznRt9Fc4V Lujwtz0P5YhXLN4Xi0FvXf33AWKi2QcC569eybt/8Sduil5aIqgK1u2Wyk4oKCs6CCjM RDRh61UniiPS+6ruFdPpM0KptcYNGmQcR7bERuEmwT4wwskcwMDLEZQqHezABlhmGymn t0/yT9GvXxiukckl8CS24wFRAVuSE+3F/ml4Rch3rTzGP28p9HA+teOVns/1YCrSYIKq jtoOvLM4tz2L1JE/0x8SqbiosBPvqrDgUUKYqrk7E5aY23fhAkX4E60MbdLqPzJfu9XM QI6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777277976; x=1777882776; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=SeS7jfeq02kdIfdPZeM3Est0x/TfzAtyHosBJLLc1RM=; b=fQ1fTa1tBw1Dt5/G1Vs2JpfKqwBwkdXrj5J01PvNbdUnRWzMu9kjQLmmftSRZs7s4f Yf6XcDnxXM6Scbjq8C1MKbA08KQ1fXn/C77Dxx2xz7/r6MaUj/sLTwwt+VA+7gpHWnSv l0UTrefRxPvf8ZrmVNSMVLUg1nAL8AkHEk0aWn/Bdd4MihSBzN6/tMWuF3TZ0sUof5ue ImzckjanTL3o67Xmut140v3sWvMkRxWW/HfY4MsIons8xGEphCMbMyIE0MoEva61Iqma rEaFcSo3+wpvqt0lCYdtwlUSPUrtFIoS0w0Dpo+L4lpCnVnGLLvsw6UU+gaAkAGy6mk/ Zj+Q== X-Forwarded-Encrypted: i=1; AFNElJ+0l/B7loSFJO7Pwp24CCDz/f07VhWMp6HKWQn8B3N9jR06gJSKNNdX0xaq+VtWvuNFOTzsiYSM5aUg8Bw=@vger.kernel.org X-Gm-Message-State: AOJu0YwtsT22s7x4TtNB5Fv88Eil2zzNyg45VZ11hVekDQt3BLVdGUef z2ni8xqCHGRx77j/UZ08en0ChJpPCYaH+J7NUQAVFyt2blrToO9umevK X-Gm-Gg: AeBDiesb6enYV0FHuAmH/oRY3XitsbWMVGJBABsYOpcv/mY1NE2UyEDpDw6/ZiGWa77 8ACbuKkGlHhnrnHObzdhURjpNlrhiQzbO3xv8kOa7bgNnIJbKSB/CwOt7iznNwnZJm7dIB5P8wM s2qbPkuAeS7mnyd4pRF9RM0XKS34HdI4eRF+Pg2C3s8tBudAXcP5Z1qz6gRt9HN6JI+HHNDV9tI Ua0YeMgHoY4YfHnFdQwpI/LJUh5gr19ZahkaZZ3vkELzOvhuiW4jrUSkxs7IPtjh/kLWF2Lo9tH UociqXf1qU6NeI6N3bfawOeTBJp8a7YzemasaN6K8g2dNJpq59iZK1+9vy99DpaVuP0mPrAoI8V 5nnJlVSyZtp5D7EJurvsidJ7Mz6bjXkNTa50OdhHbGOTyih9NN8rMmoxeJxjnlzp8CbOhG5D05Q BzJghCCPlFRm9LrZ0vAMovN2sTmYz78USMhstxVKRgy01du/l+ov3/y0G7Sav5xM/fhLtvl2fAy s44zp6nFe+Xq7ovaKLakoboHlcFsvF+vbgBpZpegGL6W8Vmx4TQQLp5jU1fGJeHoyT2qGhdiG2j 2E4N8Q== X-Received: by 2002:a05:6000:25c6:b0:43d:7a08:a5f8 with SMTP id ffacd0b85a97d-43fe3e0ae91mr64294758f8f.35.1777277976246; Mon, 27 Apr 2026 01:19:36 -0700 (PDT) Received: from ahossu.localdomain ([82.78.232.184]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43fe4e3a18csm90455670f8f.20.2026.04.27.01.19.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Apr 2026 01:19:35 -0700 (PDT) From: Alexandru Hossu To: gregkh@linuxfoundation.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org Cc: error27@gmail.com, luka.gejak@linux.dev, Alexandru Hossu Subject: [PATCH v2 0/2] staging: rtl8723bs: fix OOB write in HT_caps_handler and OOB read in OnAssocRsp Date: Mon, 27 Apr 2026 10:17:46 +0200 Message-ID: <20260427081748.3407939-1-hossu.alexandru@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit v2, addressing Greg's feedback on 1/2. Greg, please drop your patch and take this one instead. Changes from v1: - 1/2: switch from early return to min_t() truncation, so APs that send an oversized HT Caps element are handled gracefully rather than rejected outright (Greg KH) 2/2 is unchanged from v1. Alexandru Hossu (2): staging: rtl8723bs: fix OOB write in HT_caps_handler() staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 4 ++++ drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) -- 2.53.0