[PATCH v2 0/2] staging: rtl8723bs: bound two IE parses

[Ali Ahmet Memis <ali@iusegentoo.com>]

v1 put a single check across five call sites and one of them was not an
HT capability site at all. It was the SSID parse in rtw_check_beacon_data(),
so the patch required an SSID of at least sizeof(struct ieee80211_ht_cap),
26 bytes, before copying it. Every SSID shorter than that would have been
dropped, which breaks bringing up an AP with an ordinary name. That was a
regression, not a fix, and I asked for v1 to be dropped here:

  https://lore.kernel.org/all/20260802151916.38931-1-ali@iusegentoo.com/

v2 splits the two apart. Patch 1 is v1 minus that hunk: the four real HT
capability sites, unchanged otherwise. Patch 2 is the check that site
actually needed, which is an upper bound rather than a lower one, since
rtw_get_ie() can hand back an element length of up to 255 for a 32 byte
destination.

I have no rtl8723bs hardware, so both are from reading the driver rather
than from an observed failure. Build tested with CONFIG_RTL8723BS=m.

Ali Ahmet Memis (2):
  staging: rtl8723bs: validate HT capability IE length before use
  staging: rtl8723bs: bound the SSID element length before copying it

 drivers/staging/rtl8723bs/core/rtw_ap.c        | 2 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 2 +-
 drivers/staging/rtl8723bs/core/rtw_mlme.c      | 2 +-
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c  | 2 +-
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)


base-commit: 2d2338c93da79b3bfe4b6099a931d9468d539952
-- 
2.55.0