From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vk1-f173.google.com (mail-vk1-f173.google.com [209.85.221.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 820A83264C0 for ; Wed, 15 Apr 2026 18:55:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776279349; cv=none; b=Y9TKRWDdbeyiWhEEybOv3WRtWc+SxiIK22DE/q5JN3j+kjYL6UPbPcjkOOzOlGSdGj2jdqJu/3IgneuxFqiyB7Gm0dj+rJWlTU5e6c3FkIC8MU2gr6BnoKa/lFRmtynhHRdmRHP47Wsap0lW1tlmahkrJGvYUcnlEK8vNwJ1N5c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776279349; c=relaxed/simple; bh=Fd2F7C28NBMqNA7NBSvFz00bwpJ9oafZoR1UGpaikho=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DczHsrnEFRNB7j7JtBoUJA6I0qAbYfGXETphP0pBp41QbTgua8PvrJsqgaZ/nhtEfYLOuLSXVEe+qunoyzRfSdu0gzBPih/zoHaguNw+zUFQpoR1JT7mpvvEZnwp8lQ9SAcUm3/H2QLNdJruzRgiqVYQ28qkocgMi5JvmLFxSKs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=OqqQ7ElU; arc=none smtp.client-ip=209.85.221.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="OqqQ7ElU" Received: by mail-vk1-f173.google.com with SMTP id 71dfb90a1353d-56a9076813bso3464047e0c.3 for ; Wed, 15 Apr 2026 11:55:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776279347; x=1776884147; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=6YWqAx6Tf+rAcS8XG7Epy7pp0WO11keOg96xigh14Ss=; b=OqqQ7ElUaRrx6kjYKxLgahroiU6Bb2wtur14s5j/3v/tq0uKrXLIWXommn70iFXqTS 1xvB+nOe+iEAuvOPDCewbTc3iXVmU7HerxbgPmm3vMTMEa/uqyz/DjQF0ZGAWZyj8Ja6 Ne0/0ba8CzJoeXYhv2dZKp6g2yCunetK09aPZAKykfpT5hiSwdjksZ22AFi4PDHg5jlT DWKi0MgTvmsmAAMQTxf4Lv1rw5kwCJUju+U2ZkP6FYX5b14i2HpRZOTPgXC+MK3jugEY g7xxOO+k5xx8cVmqOW9bWA6dvbZ2wjVrGmYNkjgFYOyjsC2mcF7mPoJ1SKF6ixTbOPEC jZTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776279347; x=1776884147; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=6YWqAx6Tf+rAcS8XG7Epy7pp0WO11keOg96xigh14Ss=; b=A/D/MZIM5S/Tyj/oCvre0DiUNYhl/1vY8k0IK/ZPcNq3RWhppBxhewpJ2JaphxLiXG xA9iP4fWl1qgVzz1sTWxgGXEfzF0nxDEPTb9VGA6LYnbfl5jrSK0W/zlUWNxgRV5QLNN TbNZP0+bVbdhNKY+3QTq4rFO3lBjjtZekMVOa06m8FphPdQm4XJy/qpA5gRMt3Aggn97 gi7/0o2B0HLS4XT5PocutCzEm9+7y//VH/B+cvyN79APhbouz+mPP8R8boayoz0ttz88 HDUqwjb73xyWmrkFf4Ol/bFI67Apn46tl2do4+5stzAnu/qO09iH6qErjr9E6xbSox38 i8pQ== X-Forwarded-Encrypted: i=1; AFNElJ89KJyHFfjQKhRyVJsl3ZWL4mR6rDZxcGFMOxCXFh+yTrHJinogzAeBN4EOYGEPaAw7w7D/OPLQhOcLkk8=@vger.kernel.org X-Gm-Message-State: AOJu0YxqLerbWsUJUN8nP906iTzw1wuI9F0m1DGg/Yo7a615PBItOOYk dI4aTzMGA/bC5Zyv1l/KMQ9iCnuMaT41I/ai4OR03UJ1+16kDxfBMud5 X-Gm-Gg: AeBDiesKBKmzkrAxT5ABh40z+NMOklmODCqxT6gVU1W5rdT7+tABJkStZ4OepjNTLkX lw/IWDSKpenI9wSznKwFW9XIAre/ZA8apU9f9fkHKVhkeSB4FkgmtTefxQduPgFCnwRShlq7s/D Ri7D/6R5VfRizFygdSkFl4HeHmQJiYDX+YPhTYEJjMUhrhQdq0rJVJVxTOXo1xmSOA5Ow/IqTGt Io7gVvJGRTfHO7c/VuARkay/cfePc09erRzDk02VCoJX3yeH0K9aD+ddR1O+dL8Imh6hgpC/4AD URF0tZ1fbGFMSPQsXclzzppDd8dYcBb6ALn1GC6nF6vqqRgCiviAPDTaPVORi1+MJozXlyqkQzG ZfEdw0lQz6A+JQGOs/6jgf2XL3/Ti2tVEps7ar7+q+AIXMaTqQuqx4Eh/P6ch00IlNq/Ih76uo5 oPvxKXjhEeoI9ZT1KydNaJAaKhDHR/lUFPjlUaY/XY5yMCZgiJowwK X-Received: by 2002:a05:6122:8483:b0:56f:6add:9041 with SMTP id 71dfb90a1353d-56f6adda1bbmr4615042e0c.11.1776279347467; Wed, 15 Apr 2026 11:55:47 -0700 (PDT) Received: from localhost.localdomain ([102.244.98.233]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-56f89feb56esm1647484e0c.15.2026.04.15.11.55.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Apr 2026 11:55:47 -0700 (PDT) From: Delene Tchio Romuald To: gregkh@linuxfoundation.org Cc: dan.carpenter@linaro.org, error27@gmail.com, luka.gejak@linux.dev, hansg@kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Delene Tchio Romuald Subject: [PATCH v4 3/5] staging: rtl8723bs: fix out-of-bounds read in portctrl() Date: Wed, 15 Apr 2026 19:54:59 +0100 Message-ID: <20260415185501.440492-4-delenetchior1@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260415185501.440492-1-delenetchior1@gmail.com> References: <20260415185501.440492-1-delenetchior1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In portctrl(), when 802.1X port control is enabled and a non-EAPOL frame is received, the ether_type is read from the LLC header without verifying that the frame actually contains enough bytes to hold the MAC header, IV and the LLC header plus two bytes of ether_type. For sufficiently short frames, the memcpy() that loads be_tmp reads past the end of the receive buffer. An attacker within WiFi radio range can exploit this by sending a crafted short frame. No authentication is required. Validate the frame length before dereferencing the LLC header; drop the frame if it is too short. Found by reviewing length validation in the receive path. Not tested on hardware. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Reviewed-by: Luka Gejak Signed-off-by: Delene Tchio Romuald --- v4: add Fixes: tag and Cc: stable (Dan Carpenter); carry Luka Gejak's Reviewed-by. v3: rebased on staging-next; sent as numbered series with proper Cc from get_maintainer.pl. v2: rebased on staging-next (v1 was based on v7.0-rc6 and did not apply). drivers/staging/rtl8723bs/core/rtw_recv.c | 28 +++++++++++++++-------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c index 00b69571bbb83..c0a1c2ab710ee 100644 --- a/drivers/staging/rtl8723bs/core/rtw_recv.c +++ b/drivers/staging/rtl8723bs/core/rtw_recv.c @@ -539,17 +539,25 @@ static union recv_frame *portctrl(struct adapter *adapter, union recv_frame *pre prtnframe = precv_frame; - /* get ether_type */ - ptr = ptr + pfhdr->attrib.hdrlen + pfhdr->attrib.iv_len + LLC_HEADER_LENGTH; - memcpy(&be_tmp, ptr, 2); - ether_type = ntohs(be_tmp); - - if (ether_type == eapol_type) - prtnframe = precv_frame; - else { - /* free this frame */ - rtw_free_recvframe(precv_frame, &adapter->recvpriv.free_recv_queue); + /* Ensure frame has LLC header and ether_type */ + if (pfhdr->len < pattrib->hdrlen + + pattrib->iv_len + LLC_HEADER_LENGTH + 2) { + rtw_free_recvframe(precv_frame, + &adapter->recvpriv.free_recv_queue); prtnframe = NULL; + } else { + /* get ether_type */ + ptr += pattrib->hdrlen + + pattrib->iv_len + + LLC_HEADER_LENGTH; + memcpy(&be_tmp, ptr, 2); + ether_type = ntohs(be_tmp); + + if (ether_type != eapol_type) { + rtw_free_recvframe(precv_frame, + &adapter->recvpriv.free_recv_queue); + prtnframe = NULL; + } } } else { /* allowed */ -- 2.43.0