Re: [PATCH] staging: rtl8723bs: fix protected RX frame validation in decrypt path

[Tianchu Chen]

August 19, 2026 at 10:45 PM, "Greg KH" <gregkh@xxxxxxxxxxxxxxxxxxx mailto:gregkh@xxxxxxxxxxxxxxxxxxx?to=%22Greg%20KH%22%20%3Cgregkh%40linuxfoundation.org%3E > wrote:


> 
> On Wed, Aug 19, 2026 at 02:22:47PM +0000, Tianchu Chen wrote:
> 
> > 
> > From: Tianchu Chen <flynnnchen@xxxxxxxxxxx>
> >  
> >  The RX software decrypt path mishandles crafted protected frames from a
> >  malicious AP in two ways:
> >  
> >  1) decryptor() never checks that a protected frame is long enough to
> >  hold the 802.11 header plus the per-cipher trailer(IV, ICV/MIC).
> >  
> >  Implementations like rtw_wep_decrypt() and rtw_aes_decrypt() all compute
> >  length = hdr.len - hdrlen - iv_len. and a shorter frame underflows the 
> >  unsigned subtraction, turning into OOB reads/writes.
> >  
> >  Reject such frames in decryptor() before touching the IV.
> >  
> >  2) validate_80211w_mgmt() uses the skb before checking whether
> >  decryptor() returned NULL. On decrypt failure the skb has been freed
> >  before being used.
> >  
> >  Bail out immediately when decryptor() fails.
> >  
> >  Discovered by Atuin - Automated Vulnerability Discovery Engine.
> >  
> >  Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> >  Cc: stable@xxxxxxxxxxxxxxx
> >  Signed-off-by: Tianchu Chen <flynnnchen@xxxxxxxxxxx>
> > 
> No assisted-by: line?
> 
> And you have read this:
>  https://lore.kernel.org/all/2026080354-skater-urgent-31b2@gregkh
> right?


Thanks for pointing out, I have not read this before.

Assisted-by: kimi-code:kimi-k3

> So did you test this on the real hardware?

Unfortunately I have no real hardware.