Re: [PATCH] staging: rtl8723bs: fix remote heap information disclosure in issue_assocreq

[Greg Kroah-Hartman]

On Tue, Apr 14, 2026 at 09:49:45PM +0200, luka.gejak@xxxxxxxxx wrote:
> From: Luka Gejak <luka.gejak@xxxxxxxxx>
> 
> When building an association request frame, the driver copies the
> ht capability ie using the attacker-controlled pIE->length from the
> ap's beacon. If the ap provides a length greater than the size of
> struct HT_caps_element (26 bytes), it causes an out-of-bounds read
> of the adjacent heap memory (HT_info and network structures).
> This uninitialized or sensitive memory is then transmitted over the air,
> resulting in a remote heap information disclosure.
> 
> Fix this by clamping the length passed to rtw_set_ie() to the actual
> size of struct HT_caps_element.
> 
> Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Luka Gejak <luka.gejak@xxxxxxxxx>
> ---
> Note: Note: Alignment of arguments in rtw_set_ie() is intentionally 
> like that to avoid WARNING: line length of 105 exceeds 100 columns.

That's not ok, please exceed the length.

thanks,

greg k-h