Re: [PATCH v2 1/2] staging: rtl8723bs: validate HT capability IE length before use

[Greg Kroah-Hartman]

On Sun, Aug 02, 2026 at 03:35:08PM +0000, Ali Ahmet Memis wrote:
> Four sites locate the HT capability element with rtw_get_ie() and then
> read through it without checking that the element is long enough:
> 
> 	p = rtw_get_ie(..., WLAN_EID_HT_CAPABILITY, &len, ...);
> 	if (p && len > 0) {
> 		pht_cap = (struct ieee80211_ht_cap *)(p + 2);
> 		ht_cap_info = le16_to_cpu(pht_cap->cap_info);
> 
> rtw_get_ie() only bounds the element against the end of the IE buffer, so
> len is whatever the sender put in the length byte. A beacon or probe
> response carrying a one byte HT capability element passes len > 0 and the
> driver then reads two bytes of cap_info, and in rtw_update_ht_cap() the
> ampdu_params_info byte after that, from beyond the element.
> 
> An HT capability element is a fixed 26 bytes, so require that much before
> dereferencing it. The frames come from the air, so the length is not
> under local control.
> 
> Signed-off-by: Ali Ahmet Memis <ali@xxxxxxxxxxxxxx>
> ---
>  drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 2 +-
>  drivers/staging/rtl8723bs/core/rtw_mlme.c      | 2 +-
>  drivers/staging/rtl8723bs/core/rtw_mlme_ext.c  | 2 +-
>  drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 2 +-
>  4 files changed, 4 insertions(+), 4 deletions(-)

What tool did you use to find and fix these and how were they tested?

thanks,

greg k-h