Re: [PATCH] staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

[Greg KH <gregkh@linuxfoundation.org>]

On Wed, Aug 05, 2026 at 04:33:44PM +0600, イムティヤズ wrote:
> The IE parsing loop in rtw_restruct_wmm_ie() reads in_ie[i + 1] (the
> length byte) and, when a vendor specific WMM IE is found, copies 9
> bytes starting from in_ie[i], while only guarding the reads with
> i + 5 < in_len. When the IE section of a beacon ends with a single
> byte remaining, in_ie[i + 1] is read one byte past the end of the
> buffer. A crafted IE with a short length field can likewise make the
> 9-byte copy read past the end of the buffer.
> 
> Validate that the 2-byte IE header and the declared payload length
> are fully in bounds, and require the WMM IE to be at least 9 bytes
> long so that the copy stays within the buffer.
> 
> Cc: stable@kernel.org
> Signed-off-by: イムティヤズ <reza1234khan1234@gmail.com>
> Assisted-by: opencode:auto/best-free
> ---
>  drivers/staging/rtl8723bs/core/rtw_mlme.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)

As per the recent announcement, you need to prove how you tested this on
real hardware and all still works properly.

thanks,

greg k-h