[PATCH] staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

[PATCH] staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

[Moksh Panicker]

rtw_get_wps_ie() iterates over IE data from network frames without
validating that the IE header and payload fit within the remaining
buffer before reading them. Specifically:

- in_ie[cnt + 1] is read without checking cnt + 1 < in_len
- memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check
- in_ie[cnt + 1] is used as length without verifying payload fits

Add bounds checks at the top of the loop body to break early if fewer
than 2 bytes remain for the IE header, or if the declared payload
extends past the end of the buffer. Also require at least 4 bytes of
payload before comparing the WPS OUI.

Fixes: 554c0a3abf21 ("staging: rtl8723bs: add r8723bs driver")
Cc: stable@vger.kernel.org
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
---
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
index d0bbe1bb979c..82dc0ad27e79 100644
--- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@ -660,7 +660,14 @@ u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
 	while (cnt < in_len) {
 		eid = in_ie[cnt];
 
-		if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
+		if (cnt + 2 > in_len)
+			break;
+
+		if (in_ie[cnt + 1] + 2 > in_len - cnt)
+			break;
+
+		if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (in_ie[cnt + 1] >= 4) &&
+		    (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
 			wpsie_ptr = &in_ie[cnt];
 
 			if (wps_ie)
-- 
2.34.1

Re: [PATCH] staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

[Greg KH]

On Thu, Jun 25, 2026 at 08:29:11PM +0000, Moksh Panicker wrote:
> rtw_get_wps_ie() iterates over IE data from network frames without
> validating that the IE header and payload fit within the remaining
> buffer before reading them. Specifically:
> 
> - in_ie[cnt + 1] is read without checking cnt + 1 < in_len
> - memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check
> - in_ie[cnt + 1] is used as length without verifying payload fits
> 
> Add bounds checks at the top of the loop body to break early if fewer
> than 2 bytes remain for the IE header, or if the declared payload
> extends past the end of the buffer. Also require at least 4 bytes of
> payload before comparing the WPS OUI.
> 
> Fixes: 554c0a3abf21 ("staging: rtl8723bs: add r8723bs driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
> ---
>  drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)

How was this issue found?  How was it tested?

thanks,

greg k-h

Re: [PATCH] staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

[Moksh Panicker]

This issue was found by code review while analyzing the OOB read
patterns fixed by Alexandru Hossu in sibling functions
(rtw_get_sec_ie, rtw_get_wapi_ie, rtw_get_wps_attr) in the same file.
The same unbounded IE iteration pattern was present in
rtw_get_wps_ie() but was not included in his series. The fix was
compile-tested against linux-next. As this is a staging driver for a
USB WiFi adapter that I do not have physical access to, runtime
testing was not possible. The fix follows the same pattern as the
accepted fixes in the sibling functions.

Thanks,
Moksh

On Tue, Jul 7, 2026 at 11:30 AM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Thu, Jun 25, 2026 at 08:29:11PM +0000, Moksh Panicker wrote:
> > rtw_get_wps_ie() iterates over IE data from network frames without
> > validating that the IE header and payload fit within the remaining
> > buffer before reading them. Specifically:
> >
> > - in_ie[cnt + 1] is read without checking cnt + 1 < in_len
> > - memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check
> > - in_ie[cnt + 1] is used as length without verifying payload fits
> >
> > Add bounds checks at the top of the loop body to break early if fewer
> > than 2 bytes remain for the IE header, or if the declared payload
> > extends past the end of the buffer. Also require at least 4 bytes of
> > payload before comparing the WPS OUI.
> >
> > Fixes: 554c0a3abf21 ("staging: rtl8723bs: add r8723bs driver")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
> > ---
> >  drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 ++++++++-
> >  1 file changed, 8 insertions(+), 1 deletion(-)
>
> How was this issue found?  How was it tested?
>
> thanks,
>
> greg k-h