From: Greg KH <gregkh@linuxfoundation.org>
To: Alexandru Hossu <hossu.alexandru@gmail.com>
Cc: linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org,
error27@gmail.com, stable@vger.kernel.org, luka.gejak@linux.dev,
hansg@kernel.org
Subject: Re: [PATCH v6 1/2] staging: rtl8723bs: fix heap overflow in OnAuthClient shared key path
Date: Mon, 4 May 2026 16:10:14 +0200 [thread overview]
Message-ID: <2026050453-scorer-rebate-3898@gregkh> (raw)
In-Reply-To: <20260415094505.1115208-1-hossu.alexandru@gmail.com>
On Wed, Apr 15, 2026 at 11:45:04AM +0200, Alexandru Hossu wrote:
> rtw_get_ie() returns the raw IE length from the received frame, which
> can be up to 255. This length is used directly in memcpy() into
> chg_txt[128] with no bounds check, allowing a heap overflow of up to
> 127 bytes when a rogue AP sends an Auth seq=2 frame with a Challenge
> Text IE longer than 128 bytes.
>
> IEEE 802.11 mandates the Challenge Text element carries exactly 128
> bytes of challenge data. Reject any element whose length field does not
> match sizeof(pmlmeinfo->chg_txt) (128).
>
> Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> Cc: stable@vger.kernel.org
> Cc: hansg@kernel.org
> Reviewed-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
> ---
> Apologies for the version numbering confusion across previous iterations.
Please address the review comments found here in your next version:
https://sashiko.dev/#/patchset/20260415094505.1115208-1-hossu.alexandru@gmail.com
thanks,
greg k-h
next prev parent reply other threads:[~2026-05-04 14:56 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-15 9:45 [PATCH v6 1/2] staging: rtl8723bs: fix heap overflow in OnAuthClient shared key path Alexandru Hossu
2026-04-15 9:45 ` [PATCH v6 2/2] staging: rtl8723bs: fix missing frame length checks in OnAuthClient Alexandru Hossu
2026-04-15 11:09 ` [PATCH v6 1/2] staging: rtl8723bs: fix heap overflow in OnAuthClient shared key path Luka Gejak
2026-05-04 14:10 ` Greg KH [this message]
2026-05-05 21:13 ` [PATCH v7 0/2] staging: rtl8723bs: fix OOB reads in OnAuth() and OnAuthClient() Alexandru Hossu
2026-05-05 21:13 ` [PATCH v7 1/2] staging: rtl8723bs: fix Challenge Text IE length checks in OnAuthClient() and OnAuth() Alexandru Hossu
2026-05-05 21:13 ` [PATCH v7 2/2] staging: rtl8723bs: fix missing frame length checks in OnAuth() and OnAuthClient() Alexandru Hossu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026050453-scorer-rebate-3898@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=error27@gmail.com \
--cc=hansg@kernel.org \
--cc=hossu.alexandru@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=luka.gejak@linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox