From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A54663C198E; Thu, 15 Jan 2026 17:15:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768497301; cv=none; b=uewEP+NJRQPJ627hif0bzjWiQ84Cwo6mYnyUFNhj2HDx6i2qXhLE4F+7+RGp+3JaQWAOZoi4D3EuLKirRd66v1wigK2+7jfrgkxcpLQXdaEw20kF1CKmxOza/t2Yn5RTWUcEIKjsvTDnqJJajuFKv5aNwKsB3o1D0AGvQM9w+go= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768497301; c=relaxed/simple; bh=dR0zWbCe/B+NghnG8+BYc/pdTDqD6rz4bl4+2GkqHJE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XDlX0UFqzAoMDfQ9bX0chg2vSUrnNRyIjLSmLwRkYeDz4EZIQ3PTtUFcs7l+wagsRkW67AG1EDJ5YDPz4TShbl8b4GqJvn7N7GSgQ2LQF/T8z+JfjrerluI3DNV+QMvUc36lDSlL6mNc0U4XM18yTQu+Eh68GS+jW6jO1yI7MQE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=y6oq9OcO; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="y6oq9OcO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E17F7C116D0; Thu, 15 Jan 2026 17:15:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768497301; bh=dR0zWbCe/B+NghnG8+BYc/pdTDqD6rz4bl4+2GkqHJE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=y6oq9OcOmFlsN5dtYQjbb/Zax3aTIpsaZnWfzdvkSVh70YqzE9w1yAXr9qeCZTHBr qdxWf7Tzgzq4FkOA5LbEgKrNUhl4knxtYkeB4MqksAWN4qLsTnyZ/53sdj/UN0DxA8 IJxMa91pEmWCyFmLE6AXZlhN2oAhbmperTH0KBWg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Navaneeth K , stable Subject: [PATCH 5.15 034/554] staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing Date: Thu, 15 Jan 2026 17:41:40 +0100 Message-ID: <20260115164247.474978495@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164246.225995385@linuxfoundation.org> References: <20260115164246.225995385@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Navaneeth K commit 502ddcc405b69fa92e0add6c1714d654504f6fd7 upstream. The Extended Supported Rates (ESR) IE handling in OnBeacon accessed *(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these offsets lie within the received frame buffer. A malformed beacon with an ESR IE positioned at the end of the buffer could cause an out-of-bounds read, potentially triggering a kernel panic. Add a boundary check to ensure that the ESR IE body and the subsequent bytes are within the limits of the frame before attempting to access them. This prevents OOB reads caused by malformed beacon frames. Signed-off-by: Navaneeth K Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c @@ -584,9 +584,11 @@ unsigned int OnBeacon(struct adapter *pa p = rtw_get_ie(pframe + sizeof(struct ieee80211_hdr_3addr) + _BEACON_IE_OFFSET_, WLAN_EID_EXT_SUPP_RATES, &ielen, precv_frame->u.hdr.len - sizeof(struct ieee80211_hdr_3addr) - _BEACON_IE_OFFSET_); if (p && ielen > 0) { - if ((*(p + 1 + ielen) == 0x2D) && (*(p + 2 + ielen) != 0x2D)) - /* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */ - *(p + 1) = ielen - 1; + if (p + 2 + ielen < pframe + len) { + if ((*(p + 1 + ielen) == 0x2D) && (*(p + 2 + ielen) != 0x2D)) + /* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */ + *(p + 1) = ielen - 1; + } } if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {