All of lore.kernel.org
 help / color / mirror / Atom feed
* FAILED: patch "[PATCH] staging: rtl8723bs: fix OOB read in update_beacon_info() IE" failed to apply to 5.10-stable tree
@ 2026-07-13 13:33 gregkh
  2026-07-15  2:45 ` [PATCH 5.10.y 01/10] staging: rtl8723bs: remove DBG_871X log argument Sasha Levin
  0 siblings, 1 reply; 12+ messages in thread
From: gregkh @ 2026-07-13 13:33 UTC (permalink / raw)
  To: hossu.alexandru, gregkh, luka.gejak, stable; +Cc: stable


The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x ed51de4a86e173c3b0ef78e039c2e49e08b11f16
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026071316-urchin-unenvied-752f@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From ed51de4a86e173c3b0ef78e039c2e49e08b11f16 Mon Sep 17 00:00:00 2001
From: Alexandru Hossu <hossu.alexandru@gmail.com>
Date: Fri, 22 May 2026 02:45:25 +0200
Subject: [PATCH] staging: rtl8723bs: fix OOB read in update_beacon_info() IE
 loop

The IE parsing loop in update_beacon_info() advances by
(pIE->length + 2) each iteration but only guards on i < len.
When a malicious AP sends a Beacon whose last IE has only one byte
remaining in the frame (the element_id byte lands at len-1), the loop
reads pIE->length from one byte past the allocated receive buffer.

Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond len, passing a truncated IE
to the handler functions.

Add two guards at the top of the loop body:
  1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
  2. Break if the IE's declared data extends past len.

Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length
for consistency with the sizeof(*pIE) guards added above.

Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-2-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index 1d37c2d5b10d..b355d8a3ceab 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -1262,7 +1262,11 @@ void update_beacon_info(struct adapter *padapter, u8 *pframe, uint pkt_len, stru
 	len = pkt_len - (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN);
 
 	for (i = 0; i < len;) {
+		if (i + sizeof(*pIE) > len)
+			break;
 		pIE = (struct ndis_80211_var_ie *)(pframe + (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN) + i);
+		if (i + sizeof(*pIE) + pIE->length > len)
+			break;
 
 		switch (pIE->element_id) {
 		case WLAN_EID_VENDOR_SPECIFIC:
@@ -1287,7 +1291,7 @@ void update_beacon_info(struct adapter *padapter, u8 *pframe, uint pkt_len, stru
 			break;
 		}
 
-		i += (pIE->length + 2);
+		i += sizeof(*pIE) + pIE->length;
 	}
 }
 


^ permalink raw reply related	[flat|nested] 12+ messages in thread
* FAILED: patch "[PATCH] staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop" failed to apply to 5.10-stable tree
@ 2026-07-13 13:33 gregkh
  2026-07-15  2:45 ` [PATCH 5.10.y 01/10] staging: rtl8723bs: remove DBG_871X log argument Sasha Levin
  0 siblings, 1 reply; 12+ messages in thread
From: gregkh @ 2026-07-13 13:33 UTC (permalink / raw)
  To: hossu.alexandru, gregkh, stable; +Cc: stable


The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 3bf39f711ff27c64be8680a8938bcc5001982e81
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026071347-leotard-finlike-cc76@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 3bf39f711ff27c64be8680a8938bcc5001982e81 Mon Sep 17 00:00:00 2001
From: Alexandru Hossu <hossu.alexandru@gmail.com>
Date: Fri, 22 May 2026 02:45:30 +0200
Subject: [PATCH] staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop

The loop in is_ap_in_tkip() iterates over IEs without verifying that
enough bytes remain before dereferencing the IE header or its payload:

- pIE->element_id and pIE->length are read without checking that
  i + sizeof(*pIE) <= ie_length, so a truncated IE at the end of the
  buffer causes an OOB read.

- For WLAN_EID_VENDOR_SPECIFIC the code compares pIE->data + 12,
  which requires pIE->length >= 16.  For WLAN_EID_RSN it compares
  pIE->data + 8, requiring pIE->length >= 12.  Neither requirement
  is checked.

Add the missing IE header and payload bounds checks and guard each
data access with an explicit pIE->length minimum, matching the
pattern established in update_beacon_info().

Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-7-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index 4c0eb93f412e..a4de538722b5 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -1308,15 +1308,23 @@ unsigned int is_ap_in_tkip(struct adapter *padapter)
 		for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.ie_length;) {
 			pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i);
 
+			if (i + sizeof(*pIE) > pmlmeinfo->network.ie_length)
+				break;
+			if (i + sizeof(*pIE) + pIE->length > pmlmeinfo->network.ie_length)
+				break;
+
 			switch (pIE->element_id) {
 			case WLAN_EID_VENDOR_SPECIFIC:
-				if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) && (!memcmp((pIE->data + 12), WPA_TKIP_CIPHER, 4)))
+				if (pIE->length >= 16 &&
+				    !memcmp(pIE->data, RTW_WPA_OUI, 4) &&
+				    !memcmp((pIE->data + 12), WPA_TKIP_CIPHER, 4))
 					return true;
 
 				break;
 
 			case WLAN_EID_RSN:
-				if (!memcmp((pIE->data + 8), RSN_TKIP_CIPHER, 4))
+				if (pIE->length >= 12 &&
+				    !memcmp((pIE->data + 8), RSN_TKIP_CIPHER, 4))
 					return true;
 				break;
 
@@ -1324,7 +1332,7 @@ unsigned int is_ap_in_tkip(struct adapter *padapter)
 				break;
 			}
 
-			i += (pIE->length + 2);
+			i += sizeof(*pIE) + pIE->length;
 		}
 
 		return false;


^ permalink raw reply related	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2026-07-15  2:46 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-13 13:33 FAILED: patch "[PATCH] staging: rtl8723bs: fix OOB read in update_beacon_info() IE" failed to apply to 5.10-stable tree gregkh
2026-07-15  2:45 ` [PATCH 5.10.y 01/10] staging: rtl8723bs: remove DBG_871X log argument Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 02/10] staging: rtl8723bs: remove all DBG_871X logs Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 03/10] staging: rtl8723bs: remove commented out " Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 04/10] staging: rtl8723bs: remove all if-else empty blocks left by DBG_871X removal Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 05/10] staging: rtl8723bs: remove empty #ifdef blocks after " Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 06/10] staging: rtl8723bs: remove unnecessary bracks on DBG_871X removal sites Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 07/10] staging: rtl8723bs: refactor to reduce indents Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 08/10] staging: rtl8723bs: remove code related to unsupported channel bandwidth Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 09/10] staging: rtl8723bs: fix camel case in IE structures Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 10/10] staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop Sasha Levin
  -- strict thread matches above, loose matches on Subject: below --
2026-07-13 13:33 FAILED: patch "[PATCH] staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop" failed to apply to 5.10-stable tree gregkh
2026-07-15  2:45 ` [PATCH 5.10.y 01/10] staging: rtl8723bs: remove DBG_871X log argument Sasha Levin

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.