From: Jesus Olmos <sha0@badchecksum.net>
To: gregkh@linuxfoundation.org
Cc: linux-staging@lists.linux.dev
Subject: Re: [PATCH v2] staging: rtl8723bs: fix stack overflow in rtw_get_wps_attr_content
Date: Sun, 20 Sep 2026 21:49:48 +0200 [thread overview]
Message-ID: <20260920194948.214750-1-sha0@badchecksum.net> (raw)
In-Reply-To: <20260901091226.444666-1-sha0@badchecksum.net>
Hi Greg,
Hardware test as requested.
Tested on a RTL8812AU USB adapter using the aircrack-ng out-of-tree
driver [1], which shares the same Realtek vendor code and vulnerable
call path as the in-tree rtl8723bs.
A crafted beacon with WPS Selected Registrar data_len=200 triggers
stack-protector during scan:
[ 2066.558409] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: _rtw_cfg80211_surveydone_event_callback+0x257/0x260 [88XXau]
[ 2066.560453] CPU: 5 PID: 8151 Comm: RTW_CMD_THREAD Tainted: P OE 6.1.0-39-amd64 #1 Debian 6.1.148-1
[ 2066.562495] Hardware name: Dell Inc. Precision 7510/02H5GH, BIOS 1.22.5 05/26/2021
[ 2066.564135] Call Trace:
[ 2066.564853] <TASK>
[ 2066.565569] dump_stack_lvl+0x44/0x5c
[ 2066.566296] panic+0x118/0x2f4
[ 2066.567020] ? _rtw_cfg80211_surveydone_event_callback+0x257/0x260 [88XXau]
[ 2066.567817] __stack_chk_fail+0x10/0x10
[ 2066.568542] _rtw_cfg80211_surveydone_event_callback+0x257/0x260 [88XXau]
[ 2066.569336] ? mlme_evt_hdl+0x63/0x80 [88XXau]
[ 2066.570107] ? rtw_cmd_thread+0x23a/0x510 [88XXau]
[ 2066.570865] ? set_tx_beacon_cmd+0xd0/0xd0 [88XXau]
[ 2066.571635] ? rtw_stop_cmd_thread+0x50/0x50 [88XXau]
[ 2066.572403] ? kthread+0xd7/0x100
[ 2066.573139] ? kthread_complete_and_exit+0x20/0x20
[ 2066.573867] ? ret_from_fork+0x1f/0x30
[ 2066.574570] </TASK>
[ 2067.487113] ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: _rtw_cfg80211_surveydone_event_callback+0x257/0x260 [88XXau] ]---
Sourcing rtl8723bs SDIO hardware for a direct in-tree test.
[1] https://github.com/aircrack-ng/rtl8812au
Jesus Olmos <sha0@badchecksum.net>
prev parent reply other threads:[~2026-09-20 19:52 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-01 7:22 [PATCH] staging: rtl8723bs: bound WPS attribute copy in rtw_get_wps_attr_content() Jesus Olmos
2026-09-01 8:16 ` Greg Kroah-Hartman
2026-09-01 9:12 ` [PATCH v2] " Jesus Olmos
2026-09-01 9:20 ` Greg Kroah-Hartman
2026-09-20 19:49 ` Jesus Olmos [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260920194948.214750-1-sha0@badchecksum.net \
--to=sha0@badchecksum.net \
--cc=gregkh@linuxfoundation.org \
--cc=linux-staging@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.