Re: [PATCH v5 3/5] staging: rtl8723bs: fix out-of-bounds read in portctrl()

Dan Carpenter
2026-04-17T05:35:51Z

On Fri, Apr 17, 2026 at 04:01:08AM +0100, Delene Tchio Romuald wrote:
> drivers/staging/rtl8723bs/core/rtw_recv.c | 21 +++++++++++++--------
> 1 file changed, 13 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c
> index 40884788a30d6..b11982fbe7e1f 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_recv.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_recv.c
> @@ -537,20 +537,25 @@ static union recv_frame *portctrl(struct adapter *adapter, union recv_frame *pre
> /* blocked */
> /* only accept EAPOL frame */
>
> - prtnframe = precv_frame;
> + /* Ensure frame has LLC header and ether_type */
> + if (pfhdr->len < pattrib->hdrlen +
> + pattrib->iv_len + LLC_HEADER_LENGTH + 2) {
> + rtw_free_recvframe(precv_frame,
> + &adapter->recvpriv.free_recv_queue);
> + return NULL;
> + }
>
> /* get ether_type */
> - ptr = ptr + pfhdr->attrib.hdrlen + pfhdr->attrib.iv_len + LLC_HEADER_LENGTH;
> + ptr += pattrib->hdrlen + pattrib->iv_len + LLC_HEADER_LENGTH;

Don't do this unrelated cleanup.

> memcpy(&be_tmp, ptr, 2);
> ether_type = ntohs(be_tmp);
>
> - if (ether_type == eapol_type)
> - prtnframe = precv_frame;
> - else {
> - /* free this frame */
> - rtw_free_recvframe(precv_frame, &adapter->recvpriv.free_recv_queue);
> - prtnframe = NULL;
> + if (ether_type != eapol_type) {
> + rtw_free_recvframe(precv_frame,
> + &adapter->recvpriv.free_recv_queue);
> + return NULL;
> }
> + prtnframe = precv_frame;

Same. If you really want to do it, it has to be in a separate patch.

regards,
dan carpenter

> } else {
> /* allowed */
> /* check decryption status, and decrypt the frame if needed */