Re: [PATCH] staging: rtl8723bs: validate WPS attribute lengths

[Laxman Acharya Padhya]

Hi Greg,

This was found during an OpenAI Codex-assisted static
review. Codex helped identify the unchecked length and draft the initial
change; I then traced the call sites. I should have disclosed that
assistance in the original submission.

The reachable path is through received scan results:
rtw_cfg80211_inform_bss() parses a WPS IE and copies the Selected Registrar
payload into the one-byte stack variable `sr`. The outer IE is validated,
but the inner attribute length was not. An oversized payload can therefore
overwrite `sr`. An attribute length of 0xffff also makes the old u16
attr_len calculation wrap to 3, after which attr_len - 4 underflows before
memcpy().

I ran git diff --check, strict checkpatch (no errors or warnings), and a
Docker ARM64 W=1 build with CONFIG_RTL8723BS=m. I did not test on hardware
or inject a malformed frame, so testing was compile and static analysis
only. I will include the appropriate Assisted-by information and improve
runtime testing before any revision.

Thanks,
Laxman

On Sun, 2 Aug 2026 at 13:03, Greg Kroah-Hartman
<gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> On Sat, Aug 01, 2026 at 11:31:11PM +0545, Laxman Acharya Padhya wrote:
> > rtw_get_wps_attr() checks that the four-byte attribute header fits in the
> > WPS information element, but trusts the payload length from that header
> > when copying the attribute and advancing to the next one. A malformed
> > attribute can therefore make the driver read beyond a received management
> > frame. Storing the total attribute length in u16 also allows the addition
> > of the header size to wrap.
> >
> > rtw_get_wps_attr_content() also copies the full payload without knowing
> > the destination size. Its callers copy the Selected Registrar attribute
> > into one-byte objects, so an oversized payload can overwrite the stack
> > even when the payload itself fits inside the information element.
> >
> > Store the total attribute length in u32 and reject attributes extending
> > past the information element. Add destination lengths to the copy helpers
> > and reject attributes that do not fit before copying them.
> >
> > Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@xxxxxxxxx>
>
> How was this found and tested?
>
> thanks,
>
> greg k-h