From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E65B73B2AA for ; Thu, 16 Apr 2026 16:36:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776357374; cv=none; b=hQZDs6xJMFYBRaDg2Mh+ax2kJKL72lSoX43pmw3eZ0zKdUtjU2PjrRk0l0WGlCIg3kER/IIZTr0c8hL2EofP1PsmZJEKf6AunfFTPHv+54ZLvozSvif0FSuM4NpytjR7wG+C/bR8HFMCd+089C4yjPhDUfxuGcoUbH1Vnmr3Rnc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776357374; c=relaxed/simple; bh=WJYVQTQOX5tRnf0OyJLQ5jgx6iHDqjgS2DHyFfvjgVs=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=SoeSTKUUskc+I446Fk/bYIWCW+orMzDhyziG+3DTYa/gG6WmQ6S1MuAOxLbrVbtBq56y4qMLB5DRLaTqQQ+gz8utonRJR63nIXiDOoU67BqFHPKl735mRhzpxCo40JHbsuEM8k5uUsNrmdY9LUB3oBd3HIpXURU5T+hGPcgVOP4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=FLhgogZ3; arc=none smtp.client-ip=209.85.221.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FLhgogZ3" Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-43cff5dafc3so5856265f8f.1 for ; Thu, 16 Apr 2026 09:36:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776357371; x=1776962171; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=vQQ9E6o3BV373q2JNSi8afwSKSRwz/rYWGVsBEc8BuM=; b=FLhgogZ3ERpT2SXTl7gOGXpRzCrZyr6PnunREmPdKATtYEJrYQIWVhY5nNjh+SP2UG FoyIsi6WxiGmBHlYLFYDrNZcGWsL0DC5Hl8KDpsS+f4rH4/jUTvHkHHuE/WT+4UnGFMr 0zjI12JZlsYvNIfUtY8Irn7wX6A/321SrzI19GI9Zh/qXU2EP7rcP/0rvqxg/pPs2+aZ DZLrsKvsuP6nKRwuCzQ06hwhNHPaQK6VmaqlzX0O8Ad1epexC+D7czGQEouAC+HezhM6 D33cUn7Fg6M496AH/JI6PHk4PzVGYDGAm10KrL5f71LZ/gB6P0cFGiN8POPJzPdZzFwK qlnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776357371; x=1776962171; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=vQQ9E6o3BV373q2JNSi8afwSKSRwz/rYWGVsBEc8BuM=; b=sZVd/XO7rn+Z7kz+RigcLM0QDcoaZUD/B5HPPoB7wC+InvFGx2nOM0UB/fugT1Kkgw tnl2EHtMi5WoWGSPbIgb344oe0Hp8cgfw4qYU7KnoktyTMeese3WQ9ypzIfNEnewTn7U qXJlPVClxBJuGeZpJC8IJU34mXR10MPtjP3qZ1V5wQdDatdlUEMqOOUxwdN9diu+UjUy Pscd5NeUKtYzexz7mlTVr+NXVe1LtsbWq5A3fZIiY/fQ57ZCmiaNZzaN7uVqwcxrgHhY /ycgHKmHLqRhIopUXpzt1HK6+ERoe7pduEwE+fVzOkQE4PiI0o2vvgH353lh5VIFH4+I bVtg== X-Forwarded-Encrypted: i=1; AFNElJ8GSBQZi+TXpa+96I4SJGK3pqHGgt7nJuhLElOy2xaL/d3VZdP1hQHZG/WhQMhxL5Atg+pOygtixpCQGyo=@vger.kernel.org X-Gm-Message-State: AOJu0Yz7iWT7YQWLMzNeS1S78b76Qt70r1jctQP/qjeDtfk3bB+uFX55 HUgggEdjA7jXhN3P6Jh8VF7F0wY8Rze3Uxj60j6Scz914pEV5y0Y3Mi9 X-Gm-Gg: AeBDiesAHo3pFUpaolf7pFXfBLYm1x3n3ssR87EV5EUZ4tUGxX6tavl4DR0W87SExtw MI/Ha+i9RQUlCil574ADK6/401byRL/pam0f902d0Ul8DcD8JZnXJc1wwP8SvLfdyFg2dIBbVme Q/fpBAZYPytZU/59CIgkurfZWUG9B0m8LSgarCHl5iufbmzZyFfnGUYBSJjIF355qO5Zpn5KNp2 J33LV4YDYBxOeO5JU9Eu6s9JmuOwxJNDINuB0IMV+ir5Ax20mEa8ac9Gxma7zeznf4Zt4FGyU4n GnnGR0CPmu4AE7f0E7FtUzHEc1/m8iIMBHLIXzWEZdLdSz3J3WwJL7sHZBV6CoGRB/BNC3rvtEI o/gXRC3SccO6NeCZJUfSzt4J19JWbH0Zq3f7Tc1o0W3HEXNvYUtgyGbgWPQQFCy5rPNJBfZvCvL T53YE2QmKJZnHul1AGMHs= X-Received: by 2002:a05:6000:24c1:b0:43d:7d6f:f529 with SMTP id ffacd0b85a97d-43fe149a3e5mr94932f8f.31.1776357370724; Thu, 16 Apr 2026 09:36:10 -0700 (PDT) Received: from localhost ([196.207.164.177]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43ead33d6d3sm15189739f8f.8.2026.04.16.09.36.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Apr 2026 09:36:10 -0700 (PDT) Date: Thu, 16 Apr 2026 19:36:06 +0300 From: Dan Carpenter To: Delene Tchio Romuald Cc: gregkh@linuxfoundation.org, dan.carpenter@linaro.org, luka.gejak@linux.dev, hansg@kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH v4 3/5] staging: rtl8723bs: fix out-of-bounds read in portctrl() Message-ID: References: <20260415185501.440492-1-delenetchior1@gmail.com> <20260415185501.440492-4-delenetchior1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260415185501.440492-4-delenetchior1@gmail.com> On Wed, Apr 15, 2026 at 07:54:59PM +0100, Delene Tchio Romuald wrote: > In portctrl(), when 802.1X port control is enabled and a non-EAPOL > frame is received, the ether_type is read from the LLC header > without verifying that the frame actually contains enough bytes to > hold the MAC header, IV and the LLC header plus two bytes of > ether_type. For sufficiently short frames, the memcpy() that loads > be_tmp reads past the end of the receive buffer. > > An attacker within WiFi radio range can exploit this by sending a > crafted short frame. No authentication is required. > > Validate the frame length before dereferencing the LLC header; drop > the frame if it is too short. > > Found by reviewing length validation in the receive path. > Not tested on hardware. > > Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") > Cc: stable@vger.kernel.org > Reviewed-by: Luka Gejak > Signed-off-by: Delene Tchio Romuald > --- > v4: add Fixes: tag and Cc: stable (Dan Carpenter); carry Luka Gejak's > Reviewed-by. > v3: rebased on staging-next; sent as numbered series with proper > Cc from get_maintainer.pl. > v2: rebased on staging-next (v1 was based on v7.0-rc6 and did not > apply). > > drivers/staging/rtl8723bs/core/rtw_recv.c | 28 +++++++++++++++-------- > 1 file changed, 18 insertions(+), 10 deletions(-) > > diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c > index 00b69571bbb83..c0a1c2ab710ee 100644 > --- a/drivers/staging/rtl8723bs/core/rtw_recv.c > +++ b/drivers/staging/rtl8723bs/core/rtw_recv.c > @@ -539,17 +539,25 @@ static union recv_frame *portctrl(struct adapter *adapter, union recv_frame *pre > > prtnframe = precv_frame; > > - /* get ether_type */ > - ptr = ptr + pfhdr->attrib.hdrlen + pfhdr->attrib.iv_len + LLC_HEADER_LENGTH; > - memcpy(&be_tmp, ptr, 2); > - ether_type = ntohs(be_tmp); > - > - if (ether_type == eapol_type) > - prtnframe = precv_frame; > - else { > - /* free this frame */ > - rtw_free_recvframe(precv_frame, &adapter->recvpriv.free_recv_queue); > + /* Ensure frame has LLC header and ether_type */ > + if (pfhdr->len < pattrib->hdrlen + > + pattrib->iv_len + LLC_HEADER_LENGTH + 2) { > + rtw_free_recvframe(precv_frame, > + &adapter->recvpriv.free_recv_queue); > prtnframe = NULL; I feel like it's sort of weird to write this as a pfhdr->len < condition. I feel like the untrusted part of the condition is the pattrib->hdrlen stuff and normally you would put the untrusted parts on the left. I kind of see what you're saying that the packet is too small, but to me I see it as the hdrlen is too big... But, also since you found the bug then you get to choose the style on this, so do which ever way you feel is best. It would be better if instead of setting "prtnframe = NULL;" here, you just did "return NULL;" instead. You've followed the pattern of the existing code, but the rule is that if the function has a 100 lines of bad style code, you should add 1 line of good style even if it's inconsistent. It makes the code slightly better and it makes the diff a lot smaller and clearer. regards, dan carpenter diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c index f78194d508df..9cedca1bd83a 100644 --- a/drivers/staging/rtl8723bs/core/rtw_recv.c +++ b/drivers/staging/rtl8723bs/core/rtw_recv.c @@ -531,6 +531,13 @@ static union recv_frame *portctrl(struct adapter *adapter, union recv_frame *pre /* only accept EAPOL frame */ prtnframe = precv_frame; + /* Ensure frame has LLC header and ether_type */ + if (pfhdr->len < pattrib->hdrlen + + pattrib->iv_len + LLC_HEADER_LENGTH + 2) { + rtw_free_recvframe(precv_frame, + &adapter->recvpriv.free_recv_queue); + return NULL; + } /* get ether_type */ ptr = ptr + pfhdr->attrib.hdrlen + pfhdr->attrib.iv_len + LLC_HEADER_LENGTH;