Re: [PATCH v5 3/5] staging: rtl8723bs: fix out-of-bounds read in portctrl()

[Dan Carpenter <error27@gmail.com>]

On Fri, Apr 17, 2026 at 04:01:08AM +0100, Delene Tchio Romuald wrote:
>  drivers/staging/rtl8723bs/core/rtw_recv.c | 21 +++++++++++++--------
>  1 file changed, 13 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c
> index 40884788a30d6..b11982fbe7e1f 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_recv.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_recv.c
> @@ -537,20 +537,25 @@ static union recv_frame *portctrl(struct adapter *adapter, union recv_frame *pre
>  			/* blocked */
>  			/* only accept EAPOL frame */
>  
> -			prtnframe = precv_frame;
> +			/* Ensure frame has LLC header and ether_type */
> +			if (pfhdr->len < pattrib->hdrlen +
> +			    pattrib->iv_len + LLC_HEADER_LENGTH + 2) {
> +				rtw_free_recvframe(precv_frame,
> +						   &adapter->recvpriv.free_recv_queue);
> +				return NULL;
> +			}
>  
>  			/* get ether_type */
> -			ptr = ptr + pfhdr->attrib.hdrlen + pfhdr->attrib.iv_len + LLC_HEADER_LENGTH;
> +			ptr += pattrib->hdrlen + pattrib->iv_len + LLC_HEADER_LENGTH;

Don't do this unrelated cleanup.

>  			memcpy(&be_tmp, ptr, 2);
>  			ether_type = ntohs(be_tmp);
>  
> -			if (ether_type == eapol_type)
> -				prtnframe = precv_frame;
> -			else {
> -				/* free this frame */
> -				rtw_free_recvframe(precv_frame, &adapter->recvpriv.free_recv_queue);
> -				prtnframe = NULL;
> +			if (ether_type != eapol_type) {
> +				rtw_free_recvframe(precv_frame,
> +						   &adapter->recvpriv.free_recv_queue);
> +				return NULL;
>  			}
> +			prtnframe = precv_frame;

Same.  If you really want to do it, it has to be in a separate patch.

regards,
dan carpenter

>  		} else {
>  			/* allowed */
>  			/* check decryption status, and decrypt the frame if needed */