Re: [PATCH] staging: rtl8723bs: validate WPS attribute lengths

[Greg Kroah-Hartman]

On Sat, Aug 01, 2026 at 11:31:11PM +0545, Laxman Acharya Padhya wrote:
> rtw_get_wps_attr() checks that the four-byte attribute header fits in the
> WPS information element, but trusts the payload length from that header
> when copying the attribute and advancing to the next one. A malformed
> attribute can therefore make the driver read beyond a received management
> frame. Storing the total attribute length in u16 also allows the addition
> of the header size to wrap.
> 
> rtw_get_wps_attr_content() also copies the full payload without knowing
> the destination size. Its callers copy the Selected Registrar attribute
> into one-byte objects, so an oversized payload can overwrite the stack
> even when the payload itself fits inside the information element.
> 
> Store the total attribute length in u32 and reject attributes extending
> past the information element. Add destination lengths to the copy helpers
> and reject attributes that do not fit before copying them.
> 
> Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@xxxxxxxxx>

How was this found and tested?

thanks,

greg k-h