Re: [PATCH 5/5] staging: rtl8723bs: fix skb->len underflow in monitor TX path

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Sun, Jul 19, 2026 at 12:02:12AM +0500, Muhammad Bilal wrote:
> rtw_cfg80211_monitor_if_xmit_entry() strips a radiotap header with
> skb_pull(skb, rtap_len), then immediately dereferences the 802.11
> header fields (frame_control, addr1, addr2) without checking that
> skb->len is still large enough to contain a struct ieee80211_hdr
> (24 bytes).
> 
> Further down, it calls:
> 
> 	skb_pull(skb, dot11_hdr_len + qos_len + snap_len -
> 			sizeof(src_mac_addr) * 2);
> 
> again with no check that skb->len covers this amount first. Plain
> skb_pull() does not itself validate the requested length against
> skb->len; on a too-short injected frame this makes skb->len
> underflow to a huge unsigned value, after which skb->data and the
> following memcpy()s operate on a corrupted skb.
> 
> This function is reachable by writing a raw frame to a monitor-mode
> network device, which does not require elevated privileges beyond
> being able to create/use a monitor-mode interface (CAP_NET_RAW).
> 
> Add explicit skb->len checks before dereferencing the 802.11 header
> and before each skb_pull(), bailing out via the existing "fail"
> error path on any mismatch.
> 
> Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
>  drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
> index 6a97afd89dc7..eac1b6ac4c67 100644
> --- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
> +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
> @@ -2034,10 +2034,15 @@ static netdev_tx_t rtw_cfg80211_monitor_if_xmit_entry(struct sk_buff *skb, struc
>  	/* Skip the ratio tap header */
>  	skb_pull(skb, rtap_len);
>  
> +	if (unlikely(skb->len < sizeof(struct ieee80211_hdr)))
> +		goto fail;

Unless you can prove that unlikely() provides better performance, please
do not do this.

Let me go revert all of these and wait for a new series.

thanks,

greg k-h