Re: [PATCH v7 1/7] staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction

[Greg KH <gregkh@linuxfoundation.org>]

On Sat, May 09, 2026 at 01:26:57AM +0300, Salman Alghamdi wrote:
> Add guards to ensure ie_length is large enough before subtracting
> fixed IE offsets to prevent unsigned integer underflow.
> 
> Signed-off-by: Salman Alghamdi <me@cipherat.com>
> ---
>  drivers/staging/rtl8723bs/core/rtw_mlme.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
> index 268f294528e6..9f21a2226dbd 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
> @@ -604,6 +604,8 @@ static bool rtw_is_desired_network(struct adapter *adapter, struct wlan_network
>  	privacy = pnetwork->network.privacy;
>  
>  	if (check_fwstate(pmlmepriv, WIFI_UNDER_WPS)) {
> +		if (pnetwork->network.ie_length < _FIXED_IE_LENGTH_)
> +			return false;
>  		if (rtw_get_wps_ie(pnetwork->network.ies + _FIXED_IE_LENGTH_, pnetwork->network.ie_length - _FIXED_IE_LENGTH_, NULL, &wps_ielen))
>  			return true;
>  		else
> @@ -617,11 +619,15 @@ static bool rtw_is_desired_network(struct adapter *adapter, struct wlan_network
>  			bselected = false;
>  
>  		if (psecuritypriv->ndisauthtype == Ndis802_11AuthModeWPA2PSK) {
> -			p = rtw_get_ie(pnetwork->network.ies + _BEACON_IE_OFFSET_, WLAN_EID_RSN, &ie_len, (pnetwork->network.ie_length - _BEACON_IE_OFFSET_));
> -			if (p && ie_len > 0)
> -				bselected = true;
> -			else
> +			if (pnetwork->network.ie_length < _BEACON_IE_OFFSET_) {
>  				bselected = false;
> +			} else {
> +				p = rtw_get_ie(pnetwork->network.ies + _BEACON_IE_OFFSET_, WLAN_EID_RSN, &ie_len, (pnetwork->network.ie_length - _BEACON_IE_OFFSET_));
> +				if (p && ie_len > 0)
> +					bselected = true;
> +				else
> +					bselected = false;
> +			}
>  		}
>  	}
>  
> -- 
> 2.54.0
> 
> 

Doesn't this fix a real bug here and should be backported to stable
kernels?  If so, can you send this as a separate patch removed from this
series?

thanks,

greg k-h