[PATCH] staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

[PATCH] staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

[イムティヤズ]

The IE parsing loop in rtw_restruct_wmm_ie() reads in_ie[i + 1] (the
length byte) and, when a vendor specific WMM IE is found, copies 9
bytes starting from in_ie[i], while only guarding the reads with
i + 5 < in_len. When the IE section of a beacon ends with a single
byte remaining, in_ie[i + 1] is read one byte past the end of the
buffer. A crafted IE with a short length field can likewise make the
9-byte copy read past the end of the buffer.

Validate that the 2-byte IE header and the declared payload length
are fully in bounds, and require the WMM IE to be at least 9 bytes
long so that the copy stays within the buffer.

Cc: stable@kernel.org
Signed-off-by: イムティヤズ <reza1234khan1234@gmail.com>
Assisted-by: opencode:auto/best-free
---
 drivers/staging/rtl8723bs/core/rtw_mlme.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index 1196ec011455..222eb380500a 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -1965,8 +1965,18 @@ int rtw_restruct_wmm_ie(struct adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_
 	while (i < in_len) {
 		ielength = initial_out_len;
 
-		if (i + 5 < in_len &&
-		    in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 &&
+		/* break if the 2-byte IE header is not fully in bounds */
+		if (i + 2 > in_len)
+			break;
+
+		/* break if the IE payload declared by the length byte
+		 * extends past the end of the buffer
+		 */
+		if (i + 2 + in_ie[i + 1] > in_len)
+			break;
+
+		if (in_ie[i] == 0xDD && in_ie[i + 1] >= 7 &&
+		    in_ie[i + 2] == 0x00 &&
 		    in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 &&
 		    in_ie[i + 5] == 0x02) {
 			for (j = i; j < i + 9; j++) {
-- 
2.55.0

Re: [PATCH] staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

[イムティヤズ]

Hello,

I'm aware of Muhammad Bilal's patch
<20260728125456.32359-4-meatuni001@gmail.com> that fixes the same
function. This patch is a superset of that one:

- It fixes the OOB read of the length byte in_ie[i + 1] when advancing
  to the next IE, which Bilal's patch also addresses.

- In addition, it fixes an OOB read in the 9-byte copy path: when a
  vendor specific IE with the 00:50:f2:02 OUI has a length byte smaller
  than 7, the loop copies in_ie[i] .. in_ie[i + 8] past the end of the
  buffer. Bilal's patch does not cover this case.

If you prefer to take Bilal's minimal fix first, I can rebase this as a
follow-up covering only the copy path. Otherwise, please let me know how
you'd like to proceed.

Thanks,
イムティヤズ

Re: [PATCH] staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

[イムティヤズ]

Hello,

I'm aware of Muhammad Bilal's patch
<20260728125456.32359-4-meatuni001@gmail.com> that fixes the same
function. This patch is a superset of that one:

- It fixes the OOB read of the length byte in_ie[i + 1] when advancing
  to the next IE, which Bilal's patch also addresses.

- In addition, it fixes an OOB read in the 9-byte copy path: when a
  vendor specific IE with the 00:50:f2:02 OUI has a length byte smaller
  than 7, the loop copies in_ie[i] .. in_ie[i + 8] past the end of the
  buffer. Bilal's patch does not cover this case.

If you prefer to take Bilal's minimal fix first, I can rebase this as a
follow-up covering only the copy path. Otherwise, please let me know how
you'd like to proceed.

Thanks,
イムティヤズ

Re: [PATCH] staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

[Greg KH]

On Wed, Aug 05, 2026 at 04:33:44PM +0600, イムティヤズ wrote:
> The IE parsing loop in rtw_restruct_wmm_ie() reads in_ie[i + 1] (the
> length byte) and, when a vendor specific WMM IE is found, copies 9
> bytes starting from in_ie[i], while only guarding the reads with
> i + 5 < in_len. When the IE section of a beacon ends with a single
> byte remaining, in_ie[i + 1] is read one byte past the end of the
> buffer. A crafted IE with a short length field can likewise make the
> 9-byte copy read past the end of the buffer.
> 
> Validate that the 2-byte IE header and the declared payload length
> are fully in bounds, and require the WMM IE to be at least 9 bytes
> long so that the copy stays within the buffer.
> 
> Cc: stable@kernel.org
> Signed-off-by: イムティヤズ <reza1234khan1234@gmail.com>
> Assisted-by: opencode:auto/best-free
> ---
>  drivers/staging/rtl8723bs/core/rtw_mlme.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)

As per the recent announcement, you need to prove how you tested this on
real hardware and all still works properly.

thanks,

greg k-h

Re: [PATCH] staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

[イムティヤズ]

Hi Greg,

Thank you for the review.

I do not have rtl8723bs hardware available, so I cannot provide the
real-hardware testing you asked for. Please drop this patch.

Thanks,
イムティヤズ