From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vk1-f179.google.com (mail-vk1-f179.google.com [209.85.221.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EAD12246BD5 for ; Wed, 15 Apr 2026 18:55:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776279336; cv=none; b=SWn42YPzjxjnmK2jI+9UCKxG2JywAIuqVsyzJoxc8aaigM4Nf+kkU3adTo3lEM1fiJitF6BM8UJST7VMr8MUmRa2eZEIaq2OhwgjeQLqrMj9ydVxuZY828LAZlYTIlFXuLz1zS8Z6vzlvQ1Vg6r4zrNSgEFxjq/ziV8gAzYvUcw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776279336; c=relaxed/simple; bh=AMAk3cxwsNhyA2MXfiMcckkHbXFD6bfBWxE14QBYKWM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HbQL7IqiZyvZoe/BCIzqpfM6DSWvfVe3z6pA61C/ddjKpATDzJUCPDJzvItNWcYxDaWsFFbkREc1RN0TwY9HDR8Nl2Pl79xESuM8E29lj4Du27jmvAe0GWiI92rEmnZ/LeR7rrkAuBlnERcrmL408tYT/7bnVSwuz9dpYUkzpME= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lHazUc/e; arc=none smtp.client-ip=209.85.221.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lHazUc/e" Received: by mail-vk1-f179.google.com with SMTP id 71dfb90a1353d-56daad0fdbaso2419609e0c.3 for ; Wed, 15 Apr 2026 11:55:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776279334; x=1776884134; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ktjLVczqk0oTNjxVLTAvpBd6V50DhQU6m2AdSOXWKC8=; b=lHazUc/eNSMqv4YWeaQiU5VGsgntIEoP0gpWIEjh2u6bxn//dp1XpczN3E+r00l46c NOn8WNdIRSQa2ajMeJW+s0mgvAJiRnCpGA85p0skzznPUOC10au3aWQX2NdVMhMxQY8F 0ENuin8VK5/5D2OFRVSqUi2uxnDbNgA9K2YQH9oLxNQImhgA8LF38uRbTZpJhGJeDUgw f8Kz1VtUJOj1zmO4MYRs4odpgSMiS3oXmXUdGq7MhI5ZuEeXpZzCFC484pCm/D+wvFsa 5c1JGd1ekq63VB3igcxp/lJABcL+KtjamRaWG+KBUvwzQsqjrTAhPMWQcGsVmWI+qi29 IaGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776279334; x=1776884134; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=ktjLVczqk0oTNjxVLTAvpBd6V50DhQU6m2AdSOXWKC8=; b=NJ/n3fWoDs8YLYpXAfcE/y83i1O56VoSwnJYVcTrx2cmUnw4ozBvhcxab+6TuNFnnc 1Afg38Xlp3H6KQDax1HBMJu+02kpbzTIsOqDRr/lbY2e11rB0Uv0yDP167Ppoe2p5fhr 0ufJcM7gtxhKn0o1K48Xf6YZXNWm37eRKCcfh3TfboieQ8pjW2GFU01BHtHCv6zyQ5IK 2raLgMpXkmx3tvd18JJ3MJFAiZLZCAlmJoCYkkqiKU3j6h2796AhbAsy7ReS2QkIyxAE Lne5dVhMVNqazW5cYWQs/1bghDcP+AcAVuQnaEtv9wJifmOuR6ieGGQ5pMujTOfKZzR9 WC7w== X-Forwarded-Encrypted: i=1; AFNElJ/ePxFF3m4wzSsNeGfCBj4C7Rbnsz28kXiG4H/FaqOOyuYJ6Mw+AJ5zpzeP6m8gVRRE2HuN9ARNxXsq7/U=@vger.kernel.org X-Gm-Message-State: AOJu0YzEcFJ0zmHWaX9VARtCEbg1SgsWlpRI6Awht2vdFDsvqYHD6/lW JkViu9H3e2wnBmt2dbezStzQ+KhHU7+QwKMVEdQHqyrMegL7ojjwvm7J X-Gm-Gg: AeBDievmORjACXNvKBUpN4F0tNKDL03FqV0FwZQkHozQa5WWVFimQ02RXZCMuYHikWl WXUEQ1gR7EblIcDXBwy8WkYShv/uG7DQe97u6N8YxG8zSvoKiDYN+Qqh1cdLNrAlmHbFwlDbZ2J mgrGYrSQPddqVd4jpaS9eiJtBdrzKcNxknixxraOQYUCkoumwqmnV/QXNdPteP37TOXte55BLtu HSkeUSOkuhBHV0VDeVArlBkWiB0Jvqn/dCXtL5Sh4L9nqASNItXHRpkHfQG8ozBCM6Lb5UYFL0G UFBpiy2enAdipnOmShbLpLDCFYbQMI3R0IgwPfhZakzvktn3QcpT+tsBz1uGsV0nouOBpvlKmBp cK8DKy/cBTLGBO1HO0TN7GJx+WME0YVYB8OpoZs5oTMJxqBrAgXRZ/XX/08cyYJRN5L6JyKSf0z R6REiTrB0bj6M/rr5r/L24mFH/rSQTphV2irixLKhfsB/2kILCpvjD4qrDYzLHbc0= X-Received: by 2002:a05:6122:2887:b0:56b:5e7e:d3fa with SMTP id 71dfb90a1353d-56f3bbd2603mr10605366e0c.7.1776279333765; Wed, 15 Apr 2026 11:55:33 -0700 (PDT) Received: from localhost.localdomain ([102.244.98.233]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-56f89feb56esm1647484e0c.15.2026.04.15.11.55.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Apr 2026 11:55:33 -0700 (PDT) From: Delene Tchio Romuald To: gregkh@linuxfoundation.org Cc: dan.carpenter@linaro.org, error27@gmail.com, luka.gejak@linux.dev, hansg@kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Delene Tchio Romuald Subject: [PATCH v4 1/5] staging: rtl8723bs: fix heap buffer overflow in recvframe_defrag() Date: Wed, 15 Apr 2026 19:54:57 +0100 Message-ID: <20260415185501.440492-2-delenetchior1@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260415185501.440492-1-delenetchior1@gmail.com> References: <20260415185501.440492-1-delenetchior1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In recvframe_defrag(), a memcpy() copies fragment data into the reassembly buffer before validating that the buffer has sufficient space. If the total reassembled payload exceeds the receive buffer capacity, this results in a heap buffer overflow. Additionally, the return values of recvframe_pull() and recvframe_pull_tail() were ignored. On failure those helpers revert their pointer updates and return NULL; continuing past such a failure would leave pfhdr->rx_tail at its pre-strip value, so the subsequent bounds check against rx_end - rx_tail would operate on stale pointers. An attacker within WiFi radio range can exploit this by sending crafted 802.11 fragmented frames. No authentication is required. Check the return values of recvframe_pull() and recvframe_pull_tail(), then verify that the fragment payload fits within the remaining buffer space before the memcpy(). Found by reviewing memory operations in the driver and tracing buffer pointer manipulation through rtw_recv.h inline helpers. Not tested on hardware. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Delene Tchio Romuald --- v4: check return values of recvframe_pull() and recvframe_pull_tail(); drop unnecessary (uint) cast; add Fixes: tag and Cc: stable (Dan Carpenter). Luka Gejak's Reviewed-by dropped because the code changed. v3: rebased on staging-next; sent as numbered series with proper Cc from get_maintainer.pl. v2: rebased on staging-next (v1 was based on v7.0-rc6 and did not apply). drivers/staging/rtl8723bs/core/rtw_recv.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c index f78194d508dfc..a739c2bada2a1 100644 --- a/drivers/staging/rtl8723bs/core/rtw_recv.c +++ b/drivers/staging/rtl8723bs/core/rtw_recv.c @@ -1127,12 +1127,26 @@ static union recv_frame *recvframe_defrag(struct adapter *adapter, wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len; - recvframe_pull(pnextrframe, wlanhdr_offset); + if (!recvframe_pull(pnextrframe, wlanhdr_offset)) { + rtw_free_recvframe(prframe, pfree_recv_queue); + rtw_free_recvframe_queue(defrag_q, pfree_recv_queue); + return NULL; + } /* append to first fragment frame's tail (if privacy frame, pull the ICV) */ - recvframe_pull_tail(prframe, pfhdr->attrib.icv_len); + if (!recvframe_pull_tail(prframe, pfhdr->attrib.icv_len)) { + rtw_free_recvframe(prframe, pfree_recv_queue); + rtw_free_recvframe_queue(defrag_q, pfree_recv_queue); + return NULL; + } + + /* Verify the receiving buffer has enough space for the fragment */ + if (pnfhdr->len > pfhdr->rx_end - pfhdr->rx_tail) { + rtw_free_recvframe(prframe, pfree_recv_queue); + rtw_free_recvframe_queue(defrag_q, pfree_recv_queue); + return NULL; + } - /* memcpy */ memcpy(pfhdr->rx_tail, pnfhdr->rx_data, pnfhdr->len); recvframe_put(prframe, pnfhdr->len); -- 2.43.0