Re: [PATCH 1/5] staging: rtl8723bs: fix OOB read in rtw_get_wps_ie()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Sat, Jul 18, 2026 at 11:54:41PM +0500, Muhammad Bilal wrote:
> rtw_get_wps_ie() walks a series of information elements taken
> directly from received/associated wireless management frames
> (beacons, probe responses, scan results). The loop condition only
> checks "cnt < in_len" before reading in_ie[cnt + 1] (the IE length
> byte) and before a 4-byte memcmp() at &in_ie[cnt + 2], with no check
> that those offsets are actually within in_len.
> 
> A malicious or malformed IE blob (e.g. a truncated vendor-specific
> IE placed near the end of the buffer) can therefore make this
> function read past the end of in_ie by up to several bytes, both in
> the loop condition path and via memcpy(wps_ie, &in_ie[cnt],
> in_ie[cnt + 1] + 2) when a spurious match occurs.
> 
> The sibling helpers rtw_get_sec_ie() and rtw_get_wapi_ie() in this
> same file already perform the equivalent "cnt + 2 > in_len" /
> "cnt + 2 + in_ie[cnt + 1] > in_len" checks, added to those two
> functions by commit 1463ca3ec660 ("staging: rtl8723bs: fix OOB reads
> in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()").
> rtw_get_wps_ie() was simply never brought in line with them. Add the
> same checks here, plus a length check before the 4-byte OUI memcmp.
> 
> Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
>  drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
> index 54f805a6b5ce..2fb5863dbeef 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
> @@ -668,9 +668,15 @@ u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
>  	cnt = 0;
>  
>  	while (cnt < in_len) {
> +		if (cnt + 2 > in_len)
> +			break;
> +		if (cnt + 2 + in_ie[cnt + 1] > in_len)
> +			break;
> +
>  		eid = in_ie[cnt];
>  
> -		if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
> +		if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (in_ie[cnt + 1] >= 4) &&
> +		    (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
>  			wpsie_ptr = &in_ie[cnt];
>  
>  			if (wps_ie)
> -- 
> 2.55.0
> 
> 

This patch doesn't apply to my tree :(