From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 568663FA5CC; Mon, 17 Aug 2026 14:42:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786977737; cv=none; b=biEjyPE5IRK8+wW4lLlbS6kKOku1cD+SViANBHTYc+BrSCt4j9tcrqTF4DsoglQReyZLqNLxF/PvmErBGiSoqzmDQi4c7alNgB0cANKT6Ty9B+Rj4ZHHTnM0mbb6SId9NmOzJVJ15TZll/3XmICTU8E2BAssm3Luf1TSY5YaEJs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786977737; c=relaxed/simple; bh=tL2haIRLb+LwaBcMsf6+tSoIX5xaUuPs5B4awJ6y5hc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kI2FlMJ3wGOYvIR2A+0iGf/q5ieyFKkh3TQgKKfJI/y49mTBDcpIhAXZLKFrCFOII3dn3mZECaY9GyDFdGs7pFsNOzXnlT6MJoJmayn+MiPmYv5Nus7+h2xJwW8SIkUGr6s6kle3fe5mMDchRN8BZCMsALcMFPzNvZTiUvMknhI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JAVfBTFL; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JAVfBTFL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AF2111F000E9; Mon, 17 Aug 2026 14:42:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786977736; bh=8v87/nigPvtIdd6mOf1zsw9uQh4G5D1Cy8FrPH1IN00=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JAVfBTFLCEXot4aNdCAqkt74v8VDwcC7df9+iu3VqPfntU5i+N3Fd27DjGWHM1Idg /tsEuVOc9iMYn/ozYxGaPC8mmWGiDruviomuzzJjB5CWZ/d6PYaKekyVHKt2c6cGpj vX4XkEwNh4aZpUIPFNMsdi24UWmdMZWSKw65U4KI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Mariano Baragiola Subject: [PATCH 5.15 431/456] staging: rtl8723bs: validate monitor transmit frame lengths Date: Mon, 17 Aug 2026 15:33:41 +0200 Message-ID: <20260817132555.996668523@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132539.792407575@linuxfoundation.org> References: <20260817132539.792407575@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mariano Baragiola commit 6829665d050983907b560173e49dcc6c11cb2730 upstream. rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes. Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable Signed-off-by: Mariano Baragiola Link: https://patch.msgid.link/20260727160859.1917096-1-mbaragiola@linux.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c @@ -2071,6 +2071,8 @@ static netdev_tx_t rtw_cfg80211_monitor_ /* Skip the ratio tap header */ skb_pull(skb, rtap_len); + if (skb->len < dot11_hdr_len) + goto fail; dot11_hdr = (struct ieee80211_hdr *)skb->data; frame_control = le16_to_cpu(dot11_hdr->frame_control); @@ -2083,6 +2085,8 @@ static netdev_tx_t rtw_cfg80211_monitor_ qos_len = 2; if ((frame_control & 0x0300) == 0x0300) dot11_hdr_len += 6; + if (skb->len < dot11_hdr_len + qos_len + snap_len) + goto fail; memcpy(dst_mac_addr, dot11_hdr->addr1, sizeof(dst_mac_addr)); memcpy(src_mac_addr, dot11_hdr->addr2, sizeof(src_mac_addr));