From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8D133AB288 for ; Tue, 28 Jul 2026 12:55:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785243313; cv=none; b=EpE4+iv1pnXcDQmGuHLepQHrWkT9pWyE5eWtft//8P93ZyJzNlihhf2FwTSE6tMea+l1MhAqJQQmoY2infPnfe0ItITmBmFEdOqGa/v5cGub9r+40bfvFLalmpHwWUMIfcsGioOkzWNn89jy+8LdQHNPns2R5cY9g36csUfL31w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785243313; c=relaxed/simple; bh=/+mqHkFHeQZWQoo91PDLcdeK72c5ehlB2OrXUNBlPiw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=N/GC8+YbS/anTiPX0Wwoq5kmAZgqevZzQIk4lN6ZKeSS0w+UMUMNeXroGHwXXmEjHTZd9vjuIm16WXmzLcelNxnLGvxTK17D2yOF4FIViuIxkQ2cs5a8hIdI+rks1ByObqHoABIa5T0+X2goB5PXPUvW9Js/xq1mVsbXeBHMjKg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WIPyzEqe; arc=none smtp.client-ip=209.85.128.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WIPyzEqe" Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4954d383e64so23469735e9.1 for ; Tue, 28 Jul 2026 05:55:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785243310; x=1785848110; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=z9ileo+nwDNfD8yfsO2EMCCm8J730wo2xe5C8RjlSbE=; b=WIPyzEqemM81XgX+dgAub7rXy65rOqsvkbWFr7oGYDfAFwiqPEVLREbb1NyS1oylEo knYn6PTxQ3L2/xvlNtuEz0aIsjf1X2SmXU5aLHiCUr9OF8RRlFAgUbVMJMvaQq8bhDuF srdPcvg2OSb2NbvN4ERU0nOCaZgnSYd1XksyUdhzTEYiUha1Te1PQzFsMBdlEtzAbplw c/O4tX0xtJ3gu2AxF45tuaWv62Y9vOan/2mQQNrKqzmPsxQEQC5W1CA+57ewj0dyxTS3 cwAU+hHO4BOavP6byJTuifDaGYU61WLci2hgMoxyEzubd+bwe0ZT1ViE4Y/zY11UcWyw yzHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785243310; x=1785848110; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=z9ileo+nwDNfD8yfsO2EMCCm8J730wo2xe5C8RjlSbE=; b=ejorbi7OD9mD6+ALNnS5b5cW63mnaCjHqDlHnyqOo6Z+/R6trV7XoYUdysY4rAM6sJ 5y/bgbPpEygNJPqx4AzOLQg0qLpZHndKYPmPyAu66BOXPeVfgJdMa/UNE2vNJyr/IrzF cXLL2dCN6IABplVclP89AsO9Twdg3UnFOKf3ojPcIY5YMxp9A3jS9qcP2aTzTioSiNiJ QjYQwagg6ufkJ3+lgeBZI614XrlJFt73hHFZrV7i6XlrX3yxpPEOl0+dtmUp9HpTLgQS Xorhne4GeelSOvHrVgLwKf2w/FMw4fY+WDduY0AHX4/0/P5yoqCzzgYsmhVIXPqwoqHk 8gTQ== X-Forwarded-Encrypted: i=1; AHgh+Rr7gC+Zyuv1Bc+wqnxIK3gVsC92vdjEqRTl/batXZyQj1Ods+M53A3RiMFItSl0q/Dm2/PiVLTDN2ZIYDY=@vger.kernel.org X-Gm-Message-State: AOJu0YxHQdHBMYuhwpud2AtXU1wjvXbOr9LAfSzbXFRURSpubHG2/wta VOe1V8f0Psu6B3bnaSmyD/WMTW6+jIIgO3l4XDRZzJpC5zVHvZB1DhYW X-Gm-Gg: AR+sD124jLpqdE8cKnQESQacKFhyvFl5u6t5X7axvlgcuWcJEF0srlFPmI8+XhNzg7Y F3MvyvekSrSWuMqNqtOjPbXC+4ONMjtMcLk+EW//8WXyRXjneNjyAXogoNccWIY2HYlJoUqpSkH yg0uHiwrCH0qBgwwcNxTVL+Hs7xyN+D8oeHAREAg7iSsk6n7a8PYCIOZ/EzPEB/+T57qM+4+40N RKHEejucsUR6wCE0Y+wc++K5w1cZCYA0Mt0hIuKeq+B/GUpkL2vTjIV4N16QpCWTJtzfUjRzS8C Jqq7Y0yuWTQufEAZeAKQ32g8YMt8GPqWAE4skH3tlQroTrDBKy+Fv11YkDkx8ZKjN6Nk6JbJNac Snm0T+w5Y8lFotmtqSKd8ZJzPV8H1uD4Ta711FCvD4NYBhE+Hs5tRorQVuvB3vyesMNnWi/wRMN /5sFYQx1NRyHezUm5xwuHfEo1w8K+A7FMaPO0eEQo6Awaspw66fbovPv1BYYVx8yRTsw== X-Received: by 2002:a05:600c:8b2e:b0:495:4dd3:ca97 with SMTP id 5b1f17b1804b1-496c659f843mr30259395e9.29.1785243309992; Tue, 28 Jul 2026 05:55:09 -0700 (PDT) Received: from fedora ([202.47.63.86]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c444304esm74096505e9.0.2026.07.28.05.55.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Jul 2026 05:55:09 -0700 (PDT) From: Muhammad Bilal To: linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, Muhammad Bilal Subject: [PATCH v2 0/3] staging: rtl8723bs: fix multiple OOB reads in IE and frame parsing Date: Tue, 28 Jul 2026 17:54:53 +0500 Message-ID: <20260728125456.32359-1-meatuni001@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit v2 of the series fixing out-of-bounds read and buffer overflow bugs in the rtl8723bs staging driver where length or offset fields from untrusted wireless frames are used without validating that enough bytes remain in the buffer. Changes since v1: - Dropped patch 1/5 ("fix OOB read in rtw_get_wps_ie()") - did not apply. - Dropped patch 5/5 ("fix skb->len underflow in monitor TX path"). Muhammad Bilal (3): staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 7 +++++++ drivers/staging/rtl8723bs/core/rtw_mlme.c | 3 +++ 2 files changed, 10 insertions(+) -- 2.55.0