Re: [PATCH] staging: rtl8723bs: validate WPS attribute lengths

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Sun, Aug 02, 2026 at 01:57:09PM +0545, Laxman Acharya Padhya wrote:
> Hi Greg,
> 
> This was found during an OpenAI Codex-assisted static
> review. Codex helped identify the unchecked length and draft the initial
> change; I then traced the call sites. I should have disclosed that
> assistance in the original submission.

Please do so.

> The reachable path is through received scan results:
> rtw_cfg80211_inform_bss() parses a WPS IE and copies the Selected Registrar
> payload into the one-byte stack variable `sr`. The outer IE is validated,
> but the inner attribute length was not. An oversized payload can therefore
> overwrite `sr`. An attribute length of 0xffff also makes the old u16
> attr_len calculation wrap to 3, after which attr_len - 4 underflows before
> memcpy().
> 
> I ran git diff --check, strict checkpatch (no errors or warnings), and a
> Docker ARM64 W=1 build with CONFIG_RTL8723BS=m. I did not test on hardware
> or inject a malformed frame, so testing was compile and static analysis
> only. I will include the appropriate Assisted-by information and improve
> runtime testing before any revision.

Please test stuff like this on real hardware, so we know you didn't
break anything.

thanks,

greg k-h