Re: [PATCH] staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

[Moksh Panicker]

This issue was found by code review while analyzing the OOB read
patterns fixed by Alexandru Hossu in sibling functions
(rtw_get_sec_ie, rtw_get_wapi_ie, rtw_get_wps_attr) in the same file.
The same unbounded IE iteration pattern was present in
rtw_get_wps_ie() but was not included in his series. The fix was
compile-tested against linux-next. As this is a staging driver for a
USB WiFi adapter that I do not have physical access to, runtime
testing was not possible. The fix follows the same pattern as the
accepted fixes in the sibling functions.

Thanks,
Moksh

On Tue, Jul 7, 2026 at 11:30 AM Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> On Thu, Jun 25, 2026 at 08:29:11PM +0000, Moksh Panicker wrote:
> > rtw_get_wps_ie() iterates over IE data from network frames without
> > validating that the IE header and payload fit within the remaining
> > buffer before reading them. Specifically:
> >
> > - in_ie[cnt + 1] is read without checking cnt + 1 < in_len
> > - memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check
> > - in_ie[cnt + 1] is used as length without verifying payload fits
> >
> > Add bounds checks at the top of the loop body to break early if fewer
> > than 2 bytes remain for the IE header, or if the declared payload
> > extends past the end of the buffer. Also require at least 4 bytes of
> > payload before comparing the WPS OUI.
> >
> > Fixes: 554c0a3abf21 ("staging: rtl8723bs: add r8723bs driver")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Moksh Panicker <mokshpanicker.7@xxxxxxxxx>
> > ---
> >  drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 ++++++++-
> >  1 file changed, 8 insertions(+), 1 deletion(-)
>
> How was this issue found?  How was it tested?
>
> thanks,
>
> greg k-h