* [PATCH v3 01/22] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
[not found] <20260208105853.46192-1-luka.gejak@linux.dev>
@ 2026-02-08 10:58 ` luka.gejak
0 siblings, 0 replies; 3+ messages in thread
From: luka.gejak @ 2026-02-08 10:58 UTC (permalink / raw)
To: lukagejak5; +Cc: Luka Gejak, stable
From: Luka Gejak <luka.gejak@linux.dev>
The current code checks 'i + 5 < in_len' at the end of the if statement.
However, it accesses 'in_ie[i + 5]' before that check, which can lead
to an out-of-bounds read. Move the length check to the beginning of the
conditional to ensure the index is within bounds before accessing the
array.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
---
drivers/staging/rtl8723bs/core/rtw_mlme.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index 22dc36e8e38a..2bd6f5367bdc 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -1988,7 +1988,10 @@ int rtw_restruct_wmm_ie(struct adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_
while (i < in_len) {
ielength = initial_out_len;
- if (in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 && in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 && in_ie[i + 5] == 0x02 && i + 5 < in_len) { /* WMM element ID and OUI */
+ if (i + 5 < in_len &&
+ in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 &&
+ in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 &&
+ in_ie[i + 5] == 0x02) {
for (j = i; j < i + 9; j++) {
out_ie[ielength] = in_ie[j];
ielength++;
--
2.52.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH v3 00/22] staging: rtl8723bs: fix out-of-bounds and various cleanups
@ 2026-02-08 11:00 luka.gejak
2026-02-08 11:00 ` [PATCH v3 01/22] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie luka.gejak
0 siblings, 1 reply; 3+ messages in thread
From: luka.gejak @ 2026-02-08 11:00 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: Dan Carpenter, linux-staging, linux-kernel, Luka Gejak
From: Luka Gejak <luka.gejak@linux.dev>
Patches 2, 3, 4, and 5 from the v2 series have been accepted and
applied to the staging-next branch, so they are excluded from this
version. This series has been rebased on top of the latest staging-next.
Changes in v3:
- Rebased on staging-next.
- Dropped patches 2, 3, 4, and 5 (already applied upstream).
- Fixed a formatting error in the subject line of Patch 1 (removed
extra space after the prefix).
- No logical changes to the remaining patches (6-26).
Luka Gejak (22):
staging: rtl8723bs: fix potential out-of-bounds read in
rtw_restruct_wmm_ie
staging: rtl8723bs: remove unused rtl8192c function declarations
staging: rtl8723bs: remove unused RECV_BLK defines
staging: rtl8723bs: remove unused MAX_PATH_NUM defines
staging: rtl8723bs: convert PSTA_INFO_T to struct sta_info *
staging: rtl8723bs: remove NDIS type aliases
staging: rtl8723bs: remove redundant MAC_ARG macro
staging: rtl8723bs: core: fix line lengths in rtw_wlan_util.c
staging: rtl8723bs: core: fix line lengths in rtw_recv.c
staging: rtl8723bs: hal: fix line lengths in HalPhyRf_8723B.c
staging: rtl8723bs: os_dep: fix line lengths in ioctl_cfg80211.c
staging: rtl8723bs: hal: fix line lengths in rtl8723b_cmd.c
staging: rtl8723bs: hal: fix line lengths in rtl8723b_hal_init.c
staging: rtl8723bs: hal: fix line lengths in rtl8723b_phycfg.c
staging: rtl8723bs: core: fix various line length overflows
staging: rtl8723bs: hal: fix various line length overflows
staging: rtl8723bs: os_dep: fix various line length overflows
staging: rtl8723bs: core: fix line lengths in rtw_cmd.c
staging: rtl8723bs: core: fix line lengths in rtw_mlme_ext.c
staging: rtl8723bs: core: fix line lengths in rtw_mlme.c
staging: rtl8723bs: core: fix line lengths in rtw_xmit.c
staging: rtl8723bs: core: fix various line length overflows
drivers/staging/rtl8723bs/core/rtw_cmd.c | 147 +++---
.../staging/rtl8723bs/core/rtw_ieee80211.c | 36 +-
drivers/staging/rtl8723bs/core/rtw_io.c | 4 +-
.../staging/rtl8723bs/core/rtw_ioctl_set.c | 16 +-
drivers/staging/rtl8723bs/core/rtw_mlme.c | 106 ++--
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 471 ++++++++++++------
drivers/staging/rtl8723bs/core/rtw_pwrctrl.c | 3 +-
drivers/staging/rtl8723bs/core/rtw_recv.c | 120 +++--
drivers/staging/rtl8723bs/core/rtw_security.c | 11 +-
drivers/staging/rtl8723bs/core/rtw_sta_mgt.c | 2 +-
.../staging/rtl8723bs/core/rtw_wlan_util.c | 215 +++++---
drivers/staging/rtl8723bs/core/rtw_xmit.c | 44 +-
.../staging/rtl8723bs/hal/HalBtc8723b1Ant.c | 35 +-
.../staging/rtl8723bs/hal/HalBtc8723b2Ant.c | 29 +-
drivers/staging/rtl8723bs/hal/HalPhyRf.c | 36 +-
.../staging/rtl8723bs/hal/HalPhyRf_8723B.c | 176 +++++--
.../staging/rtl8723bs/hal/hal_com_phycfg.c | 22 +-
drivers/staging/rtl8723bs/hal/hal_intf.c | 4 +-
drivers/staging/rtl8723bs/hal/hal_sdio.c | 4 +-
drivers/staging/rtl8723bs/hal/odm.c | 28 +-
drivers/staging/rtl8723bs/hal/odm.h | 11 +-
drivers/staging/rtl8723bs/hal/odm_DIG.c | 38 +-
drivers/staging/rtl8723bs/hal/odm_HWConfig.c | 19 +-
drivers/staging/rtl8723bs/hal/odm_types.h | 3 -
drivers/staging/rtl8723bs/hal/rtl8723b_cmd.c | 103 +++-
.../staging/rtl8723bs/hal/rtl8723b_hal_init.c | 64 ++-
.../staging/rtl8723bs/hal/rtl8723b_phycfg.c | 54 +-
.../staging/rtl8723bs/hal/rtl8723b_rf6052.c | 6 +-
.../staging/rtl8723bs/hal/rtl8723bs_recv.c | 6 +-
.../staging/rtl8723bs/hal/rtl8723bs_xmit.c | 5 +-
drivers/staging/rtl8723bs/hal/sdio_halinit.c | 17 +-
drivers/staging/rtl8723bs/include/ieee80211.h | 1 -
.../staging/rtl8723bs/include/rtl8192c_recv.h | 8 -
.../staging/rtl8723bs/include/rtw_ioctl_set.h | 3 -
.../staging/rtl8723bs/include/rtw_mlme_ext.h | 2 +-
.../staging/rtl8723bs/include/wlan_bssdef.h | 12 +-
.../staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 136 +++--
drivers/staging/rtl8723bs/os_dep/os_intfs.c | 17 +-
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 +-
drivers/staging/rtl8723bs/os_dep/xmit_linux.c | 8 +-
40 files changed, 1355 insertions(+), 670 deletions(-)
--
2.52.0
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH v3 01/22] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
2026-02-08 11:00 [PATCH v3 00/22] staging: rtl8723bs: fix out-of-bounds and various cleanups luka.gejak
@ 2026-02-08 11:00 ` luka.gejak
2026-02-23 14:18 ` Greg Kroah-Hartman
0 siblings, 1 reply; 3+ messages in thread
From: luka.gejak @ 2026-02-08 11:00 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Dan Carpenter, linux-staging, linux-kernel, Luka Gejak, stable
From: Luka Gejak <luka.gejak@linux.dev>
The current code checks 'i + 5 < in_len' at the end of the if statement.
However, it accesses 'in_ie[i + 5]' before that check, which can lead
to an out-of-bounds read. Move the length check to the beginning of the
conditional to ensure the index is within bounds before accessing the
array.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
---
drivers/staging/rtl8723bs/core/rtw_mlme.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index 22dc36e8e38a..2bd6f5367bdc 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -1988,7 +1988,10 @@ int rtw_restruct_wmm_ie(struct adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_
while (i < in_len) {
ielength = initial_out_len;
- if (in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 && in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 && in_ie[i + 5] == 0x02 && i + 5 < in_len) { /* WMM element ID and OUI */
+ if (i + 5 < in_len &&
+ in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 &&
+ in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 &&
+ in_ie[i + 5] == 0x02) {
for (j = i; j < i + 9; j++) {
out_ie[ielength] = in_ie[j];
ielength++;
--
2.52.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH v3 01/22] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
2026-02-08 11:00 ` [PATCH v3 01/22] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie luka.gejak
@ 2026-02-23 14:18 ` Greg Kroah-Hartman
0 siblings, 0 replies; 3+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-23 14:18 UTC (permalink / raw)
To: luka.gejak; +Cc: Dan Carpenter, linux-staging, linux-kernel, stable
On Sun, Feb 08, 2026 at 12:00:50PM +0100, luka.gejak@linux.dev wrote:
> From: Luka Gejak <luka.gejak@linux.dev>
>
> The current code checks 'i + 5 < in_len' at the end of the if statement.
> However, it accesses 'in_ie[i + 5]' before that check, which can lead
> to an out-of-bounds read. Move the length check to the beginning of the
> conditional to ensure the index is within bounds before accessing the
> array.
>
> Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
> ---
> drivers/staging/rtl8723bs/core/rtw_mlme.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
You have mixed bugfixes that should go into 7.0-final with cleanups in
the same series, makeing it a mess for me to try to apply this. Can you
resend this as two different series, one with just bugfixes for
7.0-final and the rest being the normal coding style cleanups? That way
I can apply them properly.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-02-23 14:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260208105853.46192-1-luka.gejak@linux.dev>
2026-02-08 10:58 ` [PATCH v3 01/22] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie luka.gejak
2026-02-08 11:00 [PATCH v3 00/22] staging: rtl8723bs: fix out-of-bounds and various cleanups luka.gejak
2026-02-08 11:00 ` [PATCH v3 01/22] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie luka.gejak
2026-02-23 14:18 ` Greg Kroah-Hartman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.