Re: [PATCH] staging: rtl8723bs: fix protected RX frame validation in decrypt path

[Greg KH]

On Wed, Aug 19, 2026 at 02:22:47PM +0000, Tianchu Chen wrote:
> From: Tianchu Chen <flynnnchen@xxxxxxxxxxx>
> 
> The RX software decrypt path mishandles crafted protected frames from a
> malicious AP in two ways:
> 
> 1) decryptor() never checks that a protected frame is long enough to
> hold the 802.11 header plus the per-cipher trailer(IV, ICV/MIC).
> 
> Implementations like rtw_wep_decrypt() and rtw_aes_decrypt() all compute
> length = hdr.len - hdrlen - iv_len. and a shorter frame underflows the 
> unsigned subtraction, turning into OOB reads/writes.
> 
> Reject such frames in decryptor() before touching the IV.
> 
> 2) validate_80211w_mgmt() uses the skb before checking whether
> decryptor() returned NULL. On decrypt failure the skb has been freed
> before being used.
> 
> Bail out immediately when decryptor() fails.
> 
> Discovered by Atuin - Automated Vulnerability Discovery Engine.
> 
> Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tianchu Chen <flynnnchen@xxxxxxxxxxx>

No assisted-by: line?

And you have read this:
	https://lore.kernel.org/all/2026080354-skater-urgent-31b2@gregkh
right?

So did you test this on the real hardware?

thanks

greg k-h