Re: [PATCH] staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Jun 25, 2026 at 08:29:11PM +0000, Moksh Panicker wrote:
> rtw_get_wps_ie() iterates over IE data from network frames without
> validating that the IE header and payload fit within the remaining
> buffer before reading them. Specifically:
> 
> - in_ie[cnt + 1] is read without checking cnt + 1 < in_len
> - memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check
> - in_ie[cnt + 1] is used as length without verifying payload fits
> 
> Add bounds checks at the top of the loop body to break early if fewer
> than 2 bytes remain for the IE header, or if the declared payload
> extends past the end of the buffer. Also require at least 4 bytes of
> payload before comparing the WPS OUI.
> 
> Fixes: 554c0a3abf21 ("staging: rtl8723bs: add r8723bs driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
> ---
>  drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)

How was this issue found?  How was it tested?

thanks,

greg k-h