Re: [PATCH v2 0/3] staging: rtl8723bs: fix multiple OOB reads in IE and frame parsing

[Greg KH]

Please do not top-post.

On Tue, Aug 25, 2026 at 12:22:54PM +0500, Muhammad Bilal wrote:
> Apologies for the context-less ping, that was on me.
> 
> For reference, this is the v2 series (sent Jul 28) fixing three OOB read /
> stack overflow bugs in rtl8723bs where length or offset fields from
> untrusted wireless frames are used without validating that enough bytes
> remain in the buffer:
> 
> 1/3 fix OOB read / stack overflow in rtw_get_wps_attr()
> 2/3 fix OOB read in rtw_action_frame_parse()
> 3/3 fix OOB read in rtw_restruct_wmm_ie()
> 
> It's been about four weeks with no review comments. Just checking whether
> the series is still on your radar, or if there's anything you'd like
> changed before it can be applied.

It's in my queue to review, it's the middle of the merge window right
now and nothing can be done until after -rc1 happens.

Also, have you tested this on real hardware?

thanks,

greg k-h