From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vk1-f170.google.com (mail-vk1-f170.google.com [209.85.221.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5433236E48D for ; Fri, 17 Apr 2026 06:12:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776406346; cv=none; b=YX6UQ5WkWQJ6eP2FefM5Ptx9DCfi1H9cIl8FRKaTG1KmyIx9DN4z98n+k1VwicuYEG9gWIMn/o0TxFNwFV4rwLpysEKVpMybYIiaxsj0qnZQMr4gODO1CfT8PuvjkJbWP4VbQlpUgp/STyKb8eKzveaa/3gC6kMjK6qjz+TiNCw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776406346; c=relaxed/simple; bh=2IOSrS/BCoF+OLbUXBknmlZ3v2w7geVGIulEGVdpUXI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=p7gOXXmATX3Y0PpD2Vc2rGx7y7tHrS7DFj9TKG8cFOLZ0na2/LRdXJ4yHLmkuN6vVlgWSRxu+o44C1eM6b6uwcn+97jjTMm1FLOobD8WNn2OikGvKnc9rn8OzOVSSmo0DjYAeAyfETg4Gywxp96SFizG+1vEet01tcHGejghOmI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LozCgFjd; arc=none smtp.client-ip=209.85.221.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LozCgFjd" Received: by mail-vk1-f170.google.com with SMTP id 71dfb90a1353d-56f8c77ca6aso271847e0c.2 for ; Thu, 16 Apr 2026 23:12:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776406344; x=1777011144; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=6WeGK87I6I6uRVhZdQgQ7htgqEpuNuywO5trnD/VR80=; b=LozCgFjdJG6nOtYMPHyGdKrrNHUSpnNRVlL4WX1VHq9YkuGFVQx2BU4oCmaihZoPpm gGJX4F4+V63CPYESviJ97H8HcIyZ6tmTQ4iEOE0rXTt0ioA1zCxEoNiXNoUvPeH/Os1l cK/oPdZRhaRCzD1y67+tTwJOeNw9SypoEyDh+3VDGZe0QqxOu6SDSDlxEbc/WrFO2GE2 tHRwR7U/JIwWG4JlJ1ZA9cQJVhngeU4tn0rHMII3kamxCX+sTYdSEgH466WSWN1FEUyV zRmgqERDE2PyRe2X6+eDC29eyMTt7uzOgzfQY9UkvLg4nQh9hl7YEyZ9bqsZCBmd1Y5A CqiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776406344; x=1777011144; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=6WeGK87I6I6uRVhZdQgQ7htgqEpuNuywO5trnD/VR80=; b=LE5hFE8eXuTir5HuiEI74p96O+7QTTRkFHs+iTyEmdGf/oyz+4lOiPl4Vz4+4Tp0wJ y/NvkL+b/4tlgOoVxLOYBwz/CHeIhUM/3OODnixFJFe733bCGPXrUhpGFjBDaG+gUgrL BUOZ/HGTeqcBmz0MUmy8KFbaeg9JNUanacGsEMRDcE7PKR+akf6v4HOIp8am9hccHLGO ZvRvuGXZnShkYXg/VyZjNqs5rlWWN+5md8zlnRmWwX88LEpPsyUniUodpRSduFVfLvvl bl/LJiWTWgjUS9gJUc6GHebUBr584x+HwJmL92TP8txqeMv55d+q664zeVsG0Mftg7mg aYNQ== X-Forwarded-Encrypted: i=1; AFNElJ+nZlWDvAikUnmjVrM3aIBz1CAQv2ui0PvQwH4DWoA2QHSq4tm9xuLmA0B9C2vOLNM6Zg3B4jxSQ1NkGMo=@vger.kernel.org X-Gm-Message-State: AOJu0Yy7GvIp/hOT3xrlwwSer+XVXggBVXr/pw4Cq/NRV3kUoMKS5iXU 5q7QGjuBn7nZ2F/DR995PI8NV6EUl2/LC7b8wwIZ0pVDbZYcuUFJ9mzy X-Gm-Gg: AeBDieuMLpNviN9FZIgleL9XxElQGZmBRASmtLCOuZamIoSvHLhLMsEHwgucHG+cw06 Nl/1rD/ak3t5Ly5uL7Ad942tIJABzknFdPYgLQFrlaziyqoDsJUuBmqV7Xc9IJKMZmkpxCM29EP qmBTS8hOW/uciXiSare8pFPeAc2OzcpBRlmho/SxCkiNaXXTDtmy+pKFgJRGQl6GTVjYXh/vj9p +qEBnKI4lgiOAbxMq75lP64hRAO83P7Nv1DHKEKlxg+C91qE82v01J+r29JDK1MCJUeFXjLLMg0 n+FAK37ihPleN4eQaCjrpuyofSN4qhkM8HfcbIOG6VgJNaqzfuNQWcqX5BW8L5Xr2tYkivRA7ZV RlZ4Stpqy8S1927Yz4sedMumxIKNP0huIy8fYSSogzAI0mV6zhFhOrM3FXaIm+PCub4vTZsatMU emv5l5aCoI04/LUesSl3Q2gXSo5l/Ub3S4WIyImRouXwT27FfdIBVo X-Received: by 2002:a05:6122:1795:b0:56e:e80c:bb25 with SMTP id 71dfb90a1353d-56fa5a9dd17mr699227e0c.13.1776406344185; Thu, 16 Apr 2026 23:12:24 -0700 (PDT) Received: from localhost.localdomain ([102.244.98.124]) by smtp.gmail.com with ESMTPSA id a1e0cc1a2514c-9589093a8bbsm297947241.3.2026.04.16.23.12.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Apr 2026 23:12:23 -0700 (PDT) From: Delene Tchio Romuald To: gregkh@linuxfoundation.org Cc: error27@gmail.com, luka.gejak@linux.dev, hansg@kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Delene Tchio Romuald Subject: [PATCH v6 3/5] staging: rtl8723bs: fix out-of-bounds read in portctrl() Date: Fri, 17 Apr 2026 07:10:46 +0100 Message-ID: <20260417061048.62484-4-delenetchior1@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260417061048.62484-1-delenetchior1@gmail.com> References: <20260417061048.62484-1-delenetchior1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In portctrl(), when 802.1X port control is enabled and a non-EAPOL frame is received, the ether_type is read from the LLC header without verifying that the frame actually contains enough bytes to hold the MAC header, IV and the LLC header plus two bytes of ether_type. For sufficiently short frames, the memcpy() that loads be_tmp reads past the end of the receive buffer. An attacker within WiFi radio range can exploit this by sending a crafted short frame. No authentication is required. Validate the frame length before dereferencing the LLC header; drop the frame if it is too short. Found by reviewing length validation in the receive path. Not tested on hardware. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Delene Tchio Romuald --- v6: drop the unrelated cleanups (ptr = ptr + X -> ptr += X, ether_type inversion into direct return NULL); the patch now only adds the short-frame length check before dereferencing the LLC header (Dan Carpenter). v5: return NULL directly on the short-frame and non-EAPOL error paths (Dan Carpenter). v4: add Fixes: tag and Cc: stable (Dan Carpenter). v3: rebased on staging-next; sent as numbered series with proper Cc from get_maintainer.pl. v2: rebased on staging-next (v1 was based on v7.0-rc6 and did not apply). drivers/staging/rtl8723bs/core/rtw_recv.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c index e30617875a69d..b476f7a03a234 100644 --- a/drivers/staging/rtl8723bs/core/rtw_recv.c +++ b/drivers/staging/rtl8723bs/core/rtw_recv.c @@ -539,6 +539,14 @@ static union recv_frame *portctrl(struct adapter *adapter, union recv_frame *pre prtnframe = precv_frame; + /* Ensure frame has LLC header and ether_type */ + if (pfhdr->len < pattrib->hdrlen + + pattrib->iv_len + LLC_HEADER_LENGTH + 2) { + rtw_free_recvframe(precv_frame, + &adapter->recvpriv.free_recv_queue); + return NULL; + } + /* get ether_type */ ptr = ptr + pfhdr->attrib.hdrlen + pfhdr->attrib.iv_len + LLC_HEADER_LENGTH; memcpy(&be_tmp, ptr, 2); -- 2.43.0