From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A537D49251F for ; Tue, 5 May 2026 17:38:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778002713; cv=none; b=gCWECN2oqcsBAX9Sz6x3MsICcT5YnADa4fzZfspfU1460Hz7sNyIbnDkZdV/jXAaAYuQ9zt4hazxxTzGPO94ES4ZiY5bYIzCRLukxkbQU2JyeqzRK2JPxUOARumeGmGmHk+wJiiczPD8Wm5AKNYnlsm5GXj+rRmL06AGl4fnYiU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778002713; c=relaxed/simple; bh=RdfwN/LYtP4aF0CJvFVTs0hMjHmoDcKmx6pMoxp/CbY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Jwc4S+xnOSU2vHcWSZkeFrnVg5NRWn2VWzVf0aO6kD/XwXy3/0PlhI40QZGQyhV+Mrq8UhThUveHvL74b/IMGgBTT9OtjsXkZDReLoOk6XbvU9/bVMw5/Y8/vtscqD6fMwUdb59GsMtIPqp3bufuhpauvBZhi2hexww2ce5LxbM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=e7cPScKU; arc=none smtp.client-ip=209.85.221.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="e7cPScKU" Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-44a044cb827so3927598f8f.0 for ; Tue, 05 May 2026 10:38:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778002709; x=1778607509; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=2NpaDj1OSOuFZ6NR+/4KPE7w1qddaBejMbo1xZezZe4=; b=e7cPScKUBkIjLsM/wnRIfvWYqs44pZOOxqUuvbRA65u9KFl+rGl1w8meZd26yLs7yu Di63XnZ/qzQOAnFk+zydP4NHTk+sB5vuXPjm6yk71E0qX5wJvnuIAg4ZBZIfQN9UnUI/ e+JDIOF47qUpPxWTEcOc5jURbcS8ZD+3JqjrReRWSivswH4nfoTmEb4jt2pQFmibfPq6 c6DLgapoFsGv1PB/oBEueW9GkUKHJH+35DCiaoFYklkSUVMyye3Zo+qGD3iVvYButeOO pqpB2bwPzvObH/mV2oYk5hrp3kgDdoaAlmZIDNqb5HnlR+WbXePP8EyWyTTdNYTOpSyO 6EfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778002709; x=1778607509; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=2NpaDj1OSOuFZ6NR+/4KPE7w1qddaBejMbo1xZezZe4=; b=m3X9AV0ALK14qaeGRZgpYZiy01oAxK2eINzkhXJZT3WYX9GVjuCszoH47Qi0DN+XbQ bRbkPE22TE+W4y5ODXtmPLPsQ4BpB99WDaeYNoKIjugtZ9Os8599WLYYK3uZKqkZtq2k IOxC315L5E3SwU0xueBQhAv5cF0B5ku6e1NUQx/qfl9JR389ajIRb0xy5XRcRVqoxs/A O7jG2cL2LoaRIIesvoCz7J1L7KaYf7UGviD8jX32zcqT2V9Vki4XcBchinXN0FOPd7BB he6xzIxNnaWZwgPJYueEjPi1acenP0f2o5FaUi0Tq12I6WEwgz81mQjoPJuBayKqqjfi KFJg== X-Forwarded-Encrypted: i=1; AFNElJ+bCtTxjV8nrqLaTM1j0IwgTbHdl+n3E4OQXyoMKKk3Mn4k6wXu1hVcxnmXCpENQSUYXyH2yQn7LnNZSSQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzmdgwZ6Zvo7lbbsyNz91y7cBrWxoVKrGbtsV6fWPnUl1H3g+Gg G6zrpbFqOcgGLqKEtU/t+NZeXMDaFXLV12FZJ3IpjbHt2BlYB3NVSMDKJxAS8A== X-Gm-Gg: AeBDieuG645+GEwJIjTc2pC72UWDUt3g2+9LueLHO0212Xn8l4SHzGkn8ZFYgqKQWoT hSzmm9/4UN0sqh8WimWrcQUkySs+AFiDSF/q7VyoUyCLPe0hl31N5AVRUaZ7IYMEZzzOdUfCZGi zWHsrrWPIdjPI4Z5Ejyg3YgNYRWSMH9Qp+MYiSDoo/wcTkAfOTjrfr7EWaTICBTJC/MVz31vRHF yqIWHbrDeHUtK6L1KB/2ZgH452CP1Es6WLbZi1/I+fOq6fJH+SoP5DGp47Ai/e+S+e/x3cbk03h VN2DqoPOeaV7fbgZnjTWsnFgXzmuwyfDNWobvbt/k6j0I2H482Kp5Zf8rbDG7YcQcSC1zGq961O xe5WGzHK8Wa6DxbpsBcfEPiRtiIbI2U8frP43emA4tq+NYkR9miBMne27Z5B0VNZK1/qs2PPtQP jmerIOEYaDapRFT/s2Umk7CXs8xeTLPtEFLCRgpk+wYgYnZ5iuYacTwXVRWeLpbWPI1/ilQh+ku Aan4AX0q4rqCPy4QAIYiBp2v+SRdlyRGwBKLVjtgWvP7F6Sm3EOLkwpeqN0EI5dM9VR1II9xgUz eBiNPQ== X-Received: by 2002:a05:600c:8585:b0:487:2439:b7be with SMTP id 5b1f17b1804b1-48e51e0b5c1mr3428345e9.6.1778002708617; Tue, 05 May 2026 10:38:28 -0700 (PDT) Received: from ahossu.localdomain ([82.78.232.184]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48a82301ad1sm655473875e9.9.2026.05.05.10.38.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 05 May 2026 10:38:28 -0700 (PDT) From: Alexandru Hossu To: gregkh@linuxfoundation.org Cc: linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, error27@gmail.com, luka.gejak@linux.dev, stable@vger.kernel.org Subject: [PATCH v4 3/3] staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() and rtw_cfg80211_set_wpa_ie() Date: Tue, 5 May 2026 19:38:18 +0200 Message-ID: <20260505173818.3674164-4-hossu.alexandru@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260505173818.3674164-1-hossu.alexandru@gmail.com> References: <2026050436-italics-clumsy-e83c@gregkh> <20260505173818.3674164-1-hossu.alexandru@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Three out-of-bounds read or write paths: 1. rtw_get_wps_ie() reads the IE length byte without a header bounds check. The loop only guards on cnt < in_len, so when the buffer ends with a single element_id byte and no length byte, in_ie[cnt + 1] is read one byte past the end of the buffer. Add a check that at least two header bytes remain (cnt + 2 <= in_len) before reading in_ie[cnt + 1]. 2. rtw_get_wps_ie() does not verify the declared IE payload fits within in_len. After reading the length byte, the loop does not verify that in_ie[cnt + 1] + 2 bytes are available starting at cnt. A crafted length value can cause the subsequent memcmp and memcpy to read past the end of the buffer. Add a check that the full IE (header plus payload) fits within in_len. 3. rtw_get_wps_ie() reads 4 bytes from the IE payload via memcmp without checking that pIE->length >= 4. For WLAN_EID_VENDOR_SPECIFIC, the code calls memcmp(&in_ie[cnt + 2], wps_oui, 4) without first verifying that the IE payload is at least 4 bytes long. Add an in_ie[cnt + 1] >= 4 guard before the comparison. 4. rtw_cfg80211_set_wpa_ie() can overflow the 256-byte supplicant_ie buffer. supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use memcpy(..., wpa_ielen + 2) where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer. Add explicit bounds checks for both paths before memcpy. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Alexandru Hossu --- Changes in v4: - Add two IE bounds checks in rtw_get_wps_ie(): break if fewer than two header bytes remain, and break if the declared payload extends past in_len; add in_ie[cnt + 1] >= 4 guard before the 4-byte WPS OUI memcmp (sashiko review of v3). Changes in v3: - No code changes from v2. Changes in v2: - Add explicit size checks in rtw_cfg80211_set_wpa_ie() before memcpy to prevent the 256-byte supplicant_ie buffer overflow. drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 ++++++++- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 ++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c index 72b7f731dd47..d6d5f3a8db4c 100644 --- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c +++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c @@ -661,7 +661,14 @@ u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen) while (cnt < in_len) { eid = in_ie[cnt]; - if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) { + if (cnt + 2 > in_len) + break; + + if (in_ie[cnt + 1] + 2 > in_len - cnt) + break; + + if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (in_ie[cnt + 1] >= 4) && + (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) { wpsie_ptr = &in_ie[cnt]; if (wps_ie) diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c index fd3bae31b0ed..e7ba5ccfa03c 100644 --- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c @@ -1445,6 +1445,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa = rtw_get_wpa_ie(buf, &wpa_ielen, ielen); if (pwpa && wpa_ielen > 0) { + if (wpa_ielen + 2 > sizeof(padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL; + goto exit; + } if (rtw_parse_wpa_ie(pwpa, wpa_ielen + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK; @@ -1454,6 +1458,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa2 = rtw_get_wpa2_ie(buf, &wpa2_ielen, ielen); if (pwpa2 && wpa2_ielen > 0) { + if (wpa2_ielen + 2 > sizeof(padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL; + goto exit; + } if (rtw_parse_wpa2_ie(pwpa2, wpa2_ielen + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK; -- 2.53.0