From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f51.google.com (mail-yx1-f51.google.com [74.125.224.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D1D13358C4 for ; Sat, 4 Apr 2026 23:10:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775344223; cv=none; b=Zb/ZBF0Uo1slp/sPSDzzYL3ED//MLcBNcH+ggqbBqkS2TQR5WG/HKwWnYipNZ8ezfrpVFNQ7ZBt71ZNqKQOG+OpVQS6ADWNuBSoWcwmf4x/3ImgU7bVD6Di7WeMcghh0n1ndT6Y+tpznEs7Ba/NrOfLQEI7tfldjcsWPVTQGPZM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775344223; c=relaxed/simple; bh=CXe6NWtGmgae7vomAcuBTLuO3Wx/AkjmoxsKp7IFwT0=; h=Mime-Version:Content-Type:Date:Message-Id:Cc:Subject:From:To: References:In-Reply-To; b=MT/rYny9gaoOqcLuIThMptH7bm/3gdhFahNbzgqzxMCgndFlMzL5VyPJOA3vImNJs5JM8fFYVW6BWYpEdmJSzGysXSLPbfF22J3/+rHTh69QlcdF19P6lpHgzDvoC/IwQaOFC+G8iazZHChjNmsZqnlyrLbOQYNeP1wqKSBDF6Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=r79SH2Os; arc=none smtp.client-ip=74.125.224.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="r79SH2Os" Received: by mail-yx1-f51.google.com with SMTP id 956f58d0204a3-65005a8840dso2890107d50.0 for ; Sat, 04 Apr 2026 16:10:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775344221; x=1775949021; darn=vger.kernel.org; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=s4FsZioxL2aVxVY/1E/hjnxADTNtSVDk79XAZmktMYU=; b=r79SH2OsHswoDgEoTuw4v1UvYajjpW0AuMebUxO44wNsXif6D6i61f3b7NCMulxMfs 4cnJzYPLI1eGTK5Pf39yxkA/Und4erLeJldlay8QFmU6HnH7xmAq8kpZDi7g97nTMYn+ bVYvHkVUmJvG6PqOf31J4UJDk2ScX6aE1c7F/dGIpvZEzYPq8PugdlaHurNM0s0Og+zg 1I9ORh2jnoe0txQr61yXy0TFu6I6WN1LsiHpEJCCQxylI+7t6A+vNBRCTaYhndmiNDtM XSSZCmJ+TxPCDzaSCezfF3ZMoIRAqM2Rks1uC89GBtyDS08FT+iFSZp3Xv4i2Q5QPgNR CM9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775344221; x=1775949021; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=s4FsZioxL2aVxVY/1E/hjnxADTNtSVDk79XAZmktMYU=; b=sNQYE16sHCNk4cNkYb55PVt5BYMTm1lHsqGQXItDTFtlJBinESTLA06EJBfJ2GqnlR 4k0qcjlTjnV/X79VPzEzBc+lqw6vyD08asj3+UGIeZegVuBgrbNtBufC1dXjXO8nfjpa +7uFCuGyKNkjeG3aX0z4hzUTgFHH3Rh8heZMq5Kx5Vnm8KcbKk9cNr0g9uHiy5u8ZXaX NWh/q897mqxjte0OVsbIMwMlCdy1L1S4SAr5pvdTQ0CGsRCVQGZAvtTDkrNC/nG4uuIk 0hhN3tlL+qNTfOJPgrtdmbhDHLmmwLxNzhlGlnN7uS40uK7ZXI+TTUwyY7Y8icb6pRYs i0sQ== X-Forwarded-Encrypted: i=1; AJvYcCUmRB2XpfqnzfO0IhGl09GvUr4vYMp5dIw4GPDvWlQJp/W6Cd+lMa7Cx2H00+f6sJkHGY2TKCFsCTZGfu0=@vger.kernel.org X-Gm-Message-State: AOJu0YwK0G2m5CnL4I0jVJ3LuSUaFP4vXquYRTTb42qYlvb1ia1RhkDz 5YAf6/1eUjLtOgCO5MKzuvkRN/dzJShpKN9IEcvgn4OKU4/ai8JmUvvB X-Gm-Gg: AeBDiesQWl3JavSwVmVp0HAZMU9K00ZtrirklfEGPK9Qe15BPwjjqalzGbeuV7xrhgg Tfmjy9qtCU5iGrBdqIlScXpqTQPGzKRUV9fLJDdN6JByV/Oms4gcwxpqHnUyH5qYbcM2gY/j+Pi JXIPmnJOcft7/X4i8boejy0639IIr9+Jt070TGxwAmDfAvLb0VY35t7og/10uKt9ruS3jqzHLMX 1hChwZaJjBw8ZWPmfuRWcl7AF7NcNg3EW1MWC2dnClspIH9MSFu98T5i5qFk8FyebgLHqBxo5Eu AVzABwEnd9ROazj+zN5v2fg2gv2ez9h6DjI6tybL/LO+jHWHLR9Aw7++OK+iFrvBLgctLapiCCx Nfh5V94nRxIKWARBRhV5W0C8BcW/pTfDNW/DbRFktZGwmolYN4whfjFWyLC5qmDzbH8YI1RNaLr 0AfLwDtbLB8n9RmD8k9H+xC6D/yAGKC6i1eg0BojyoetM/sOnYN6McT9h1Xx4JkmnKB6OgWS1Jb MUAN+l0ofxE5VZ3DfhnNFsUpuS80rBw X-Received: by 2002:a05:690e:1246:b0:64a:dbe3:fab7 with SMTP id 956f58d0204a3-650486859edmr6868291d50.8.1775344221123; Sat, 04 Apr 2026 16:10:21 -0700 (PDT) Received: from localhost ([2601:7c0:c37e:2360::17e2]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-6503a73d18fsm4031828d50.0.2026.04.04.16.10.20 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 04 Apr 2026 16:10:20 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Sat, 04 Apr 2026 18:10:18 -0500 Message-Id: Cc: , , Subject: Re: [PATCH] staging: rtl8723bs: fix out-of-bounds reads in IE parsing functions From: "Ethan Tidmore" To: "Delene Tchio Romuald" , X-Mailer: aerc 0.21.0-0-g5549850facc2 References: <20260404223144.59168-1-delenetchior1@gmail.com> In-Reply-To: <20260404223144.59168-1-delenetchior1@gmail.com> On Sat Apr 4, 2026 at 5:31 PM CDT, Delene Tchio Romuald wrote: > The IE parsing loops in rtw_get_wapi_ie(), rtw_get_sec_ie(), and > rtw_get_wps_ie() check only that the element ID byte is within bounds > (cnt < in_len), but then immediately access the length byte at > in_ie[cnt+1] and data bytes at in_ie[cnt+2] and beyond without > verifying that these offsets are within the buffer. > > A malicious access point can send beacon or probe response frames with > truncated Information Elements, triggering out-of-bounds reads on > kernel heap memory. No authentication is required. > > Add two bounds checks to each function: > - Ensure at least 2 bytes remain for the IE header (cnt + 1 < in_len) > - Validate the full IE fits in the buffer before accessing its data > (cnt + 2 + ie_len <=3D in_len) > > Cc: stable@vger.kernel.org You'd want a proper fixes tag if this is a actual bug. > Signed-off-by: Delene Tchio Romuald > --- This doesn't apply to staging-next. Thanks, ET