Linux kernel -stable discussions
 help / color / mirror / Atom feed
* FAILED: patch "[PATCH] staging: rtl8723bs: fix OOB read in update_beacon_info() IE" failed to apply to 5.10-stable tree
@ 2026-07-13 13:33 gregkh
  2026-07-15  2:45 ` [PATCH 5.10.y 01/10] staging: rtl8723bs: remove DBG_871X log argument Sasha Levin
  0 siblings, 1 reply; 11+ messages in thread
From: gregkh @ 2026-07-13 13:33 UTC (permalink / raw)
  To: hossu.alexandru, gregkh, luka.gejak, stable; +Cc: stable


The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x ed51de4a86e173c3b0ef78e039c2e49e08b11f16
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026071316-urchin-unenvied-752f@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From ed51de4a86e173c3b0ef78e039c2e49e08b11f16 Mon Sep 17 00:00:00 2001
From: Alexandru Hossu <hossu.alexandru@gmail.com>
Date: Fri, 22 May 2026 02:45:25 +0200
Subject: [PATCH] staging: rtl8723bs: fix OOB read in update_beacon_info() IE
 loop

The IE parsing loop in update_beacon_info() advances by
(pIE->length + 2) each iteration but only guards on i < len.
When a malicious AP sends a Beacon whose last IE has only one byte
remaining in the frame (the element_id byte lands at len-1), the loop
reads pIE->length from one byte past the allocated receive buffer.

Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond len, passing a truncated IE
to the handler functions.

Add two guards at the top of the loop body:
  1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
  2. Break if the IE's declared data extends past len.

Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length
for consistency with the sizeof(*pIE) guards added above.

Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-2-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index 1d37c2d5b10d..b355d8a3ceab 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -1262,7 +1262,11 @@ void update_beacon_info(struct adapter *padapter, u8 *pframe, uint pkt_len, stru
 	len = pkt_len - (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN);
 
 	for (i = 0; i < len;) {
+		if (i + sizeof(*pIE) > len)
+			break;
 		pIE = (struct ndis_80211_var_ie *)(pframe + (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN) + i);
+		if (i + sizeof(*pIE) + pIE->length > len)
+			break;
 
 		switch (pIE->element_id) {
 		case WLAN_EID_VENDOR_SPECIFIC:
@@ -1287,7 +1291,7 @@ void update_beacon_info(struct adapter *padapter, u8 *pframe, uint pkt_len, stru
 			break;
 		}
 
-		i += (pIE->length + 2);
+		i += sizeof(*pIE) + pIE->length;
 	}
 }
 


^ permalink raw reply related	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2026-07-15  2:45 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-13 13:33 FAILED: patch "[PATCH] staging: rtl8723bs: fix OOB read in update_beacon_info() IE" failed to apply to 5.10-stable tree gregkh
2026-07-15  2:45 ` [PATCH 5.10.y 01/10] staging: rtl8723bs: remove DBG_871X log argument Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 02/10] staging: rtl8723bs: remove all DBG_871X logs Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 03/10] staging: rtl8723bs: remove commented out " Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 04/10] staging: rtl8723bs: remove all if-else empty blocks left by DBG_871X removal Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 05/10] staging: rtl8723bs: remove empty #ifdef blocks after " Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 06/10] staging: rtl8723bs: remove unnecessary bracks on DBG_871X removal sites Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 07/10] staging: rtl8723bs: refactor to reduce indents Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 08/10] staging: rtl8723bs: remove code related to unsupported channel bandwidth Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 09/10] staging: rtl8723bs: fix camel case in IE structures Sasha Levin
2026-07-15  2:45   ` [PATCH 5.10.y 10/10] staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox