From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f44.google.com (mail-ed1-f44.google.com [209.85.208.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 608EA32A3C8 for ; Sat, 18 Jul 2026 18:55:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784400914; cv=none; b=f2TS6iRC2AiuQTzvwxGg0PblK4fpm679+5DsWQrS2mw4MPBScUxFRQ30Q7MokljAXdmyH59jGf0pTJxk7L/b1XZHeBQzO/zXBbB5DJTXNcNpcmpzCua27FwvK4D64n5TYxz54r3kClilWx8sVvoQxb+TMbh3f9ElljZumwoQmZo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784400914; c=relaxed/simple; bh=RLvJyyzbDkW2Bin4M8qjdgs0Tl2RzHC+PCd/ZUhXgUo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=VXZvE3R5r4l1yohk5+HFtY1hUTDTLyfgRC+kDKvzLARY2g2W/QtpUsWcrG4iO1kWE/Y8z+0O9FvZdyaZZhYj8s7BFwtFBTx3akh+AljhxEoEuBaBUGDxNr/4nFJHmQPzWFO0DLteGjU1mHUBpQ6HE2/XVKXKc+brSnpNvpyqbEs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VhjSLUVY; arc=none smtp.client-ip=209.85.208.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VhjSLUVY" Received: by mail-ed1-f44.google.com with SMTP id 4fb4d7f45d1cf-697bd21fdc2so7063557a12.1 for ; Sat, 18 Jul 2026 11:55:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784400911; x=1785005711; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=EQeflTmYd4L1dkaVapCLSilHj8J3mnfUi8LPwpSpNOc=; b=VhjSLUVYWlyrSFgx/tU7nLe6Qa1fJP9bD7nFJHtpa4GlOdyQE4qV1iZhfckeld6nwV XITQgZq9ppVzwjpw1ne0vItqr3fFIfFNqR40QNstq39YJ7ygZe8o2Ss73Sff9hZNBjF5 FX5U46gn5wQvYPj1Ea3/o2K4jDWYNSWVGSSWbiWx2m/CspiDHVPPnq2aRkxQoyNSInG1 o6cFDR0BGTDrbX7YdoluL39cOM+/ZcwL1IaFb4z+XSKe5LRBMU27CygZo+6ssXt3YhlN Kyv4rVRAJWHx0XgnjH6hHa8PZeeuLM6bfX5DcAKpkaOyDX+B/9hZxpUFELSyD429YCnm JRjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784400911; x=1785005711; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EQeflTmYd4L1dkaVapCLSilHj8J3mnfUi8LPwpSpNOc=; b=IRhqqdd2jKR77cPlDEvxqTcCBmBuaGihmH7JuYXtR7c0S4LYjrcit/GFq0nj6D6hFc +dq/ePrSte0qtL4I41yUiHe/jV3YMs7EXPS7Pid3weKrixYTEDsYF56cdJjfuKGC/jWL 4q6pRKeGhaWqi09yqk7TaW0yTOT7jctZOkQa60Dfj91e7ZsykeAWMFzJYiYuuaziCWpx q6tNI/GTkUUrCLCS9Kty6W3mfSRBuIlb3eTBgyTz8eZidzVTxUIbEdnP2gtT9dNzGBJd Tl5A64kRP1h8virInAATQOf13PAIJ6oaYAZoacMw7poVdVtPIvlbfe16m7nkYgAa4ST+ 9dVA== X-Forwarded-Encrypted: i=1; AHgh+RqT11UFJeb28jQ1rlcpmJiJ1llNLgCcRjis524cUTHU0txpnQBgpcWGZAwEVtnHc5BoD+CLaejThoOFqbI=@vger.kernel.org X-Gm-Message-State: AOJu0Yywvp6bYXyLkyjqYbzjnGENZqt6T31fS5MzVkWcCP5p+YXJ0Rkn QoKwz5x27nAIE3Juzn/mfv9f61I5iKOR2iqQoPwQn2QaBjq4yTGaU1qkHzo5CNHv X-Gm-Gg: AfdE7cnFRse/lFtTRUqVwGJjp5q2Sg9wmCQ/dsw6K3O2YKI1qJ5chqF4dngJmrzlFrb btNEsRJipteObIzYx0hqXGOJfVMwtL5SZ5G4xduTzwmNufkXqEtLbiy0UTJHlt7JGblGO3WP/O5 03iKa69EKJwsGYL0CBKSGb/WtxC0r/TUmrBxoU/oULohPeL/7oFEQ12QMHtLH2jnv7lWkSJESoM aro1gvY2wB0aMLYLrCwYcQZHX2ztbt4831vv8BVct/BxGQ3U0Lw4wS0wX5p2/cHuoBkPdcxCwFR 6V9j07tO2HFk8Zp89zkpfuzxEAd3CAJUPlnZZH4DqYsXIawFQU3tt9srmLbnO9pyd0IDxuZrunp YaVYPhXQFRdrPb2+8jo883E2Tx9ooQEwKJ7P5ohq3+r+pcBNXp7e2cPlN6GuNStVLmkJIwAtw/h wHCt403S7v3eFaitF6LRGoqZtyKJ4wO8wdqxgyzGjq3CfhieHnDZQic/U= X-Received: by 2002:a17:907:3f86:b0:c16:12c:9aa7 with SMTP id a640c23a62f3a-c16b4886e8dmr351971766b.40.1784400911266; Sat, 18 Jul 2026 11:55:11 -0700 (PDT) Received: from fedora ([202.47.63.86]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1712a5f837sm249151866b.32.2026.07.18.11.55.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jul 2026 11:55:10 -0700 (PDT) From: Muhammad Bilal To: Greg Kroah-Hartman Cc: linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Muhammad Bilal Subject: [PATCH 0/5] staging: rtl8723bs: fix multiple OOB reads in IE and frame parsing Date: Sat, 18 Jul 2026 23:54:40 +0500 Message-ID: <20260718185445.63070-1-meatuni001@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This series fixes five out-of-bounds read and buffer overflow bugs in the rtl8723bs staging driver where length or offset fields from untrusted wireless frames are used without validating that enough bytes remain in the buffer. Patches 1-4 are reachable remotely through crafted management frames (beacons, probe responses, scan results). Patch 5 is reachable locally via raw frame injection on a monitor-mode interface. Impact: 1/5 OOB read of IE length byte and OUI data in rtw_get_wps_ie() 2/5 OOB read plus stack buffer overflow via attacker-controlled memcpy length in rtw_get_wps_attr() 3/5 OOB read of action frame category and action bytes 4/5 OOB read of next-IE length in the non-matching fallthrough path 5/5 skb->len underflow after unchecked skb_pull in monitor TX path All fixes are single-hunk bounds checks following the same pattern already used in the sibling functions in these files. Tested: CONFIG_RTL8723BS=m with CONFIG_KASAN=y, checkpatch clean. Muhammad Bilal (5): staging: rtl8723bs: fix OOB read in rtw_get_wps_ie() staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() staging: rtl8723bs: fix skb->len underflow in monitor TX path drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 15 ++++++++++++++- drivers/staging/rtl8723bs/core/rtw_mlme.c | 3 +++ drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 13 ++++++++++++- 3 files changed, 29 insertions(+), 2 deletions(-) -- 2.55.0