Skip to content

staging: rtl8723bs: fix two remote frame-handling bugs

Shayaun Nejad linux-staging linux-wireless lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest2 patches 1 replyIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/2staging: rtl8723bs: fix use-after-free in validate_80211w_mgmt after decryptor()drivers/staging/rtl8723bs/core/rtw_recv.c+7 -20 replies
2/2staging: rtl8723bs: bound SUPP_RATES IE length in rtw_check_beacon_datadrivers/staging/rtl8723bs/core/rtw_ap.c+5 -11 reply

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH 0/2] staging: rtl8723bs: fix two remote frame-handling bugs

Fix two rtl8723bs receive-side bugs reachable while handling remote 802.11 management frames.

The first patch fixes a use-after-free in validate_80211w_mgmt(), where decryptor() can release the receive frame and return NULL before the caller reuses cached pointers into that frame.

The second patch bounds the combined SUPP_RATES and EXT_SUPP_RATES IE lengths copied from beacon/probe response data into the 16-byte support_rate[] stack buffer in rtw_check_beacon_data().

Both issues were found by Kuzushi + deep-audit (Sonnet 4.6) and manually verified against mainline.

Shayaun Nejad (2):
staging: rtl8723bs: fix use-after-free in validate_80211w_mgmt after
decryptor()
staging: rtl8723bs: bound SUPP_RATES IE length in
rtw_check_beacon_data

 drivers/staging/rtl8723bs/core/rtw_ap.c   | 6 +++++-
 drivers/staging/rtl8723bs/core/rtw_recv.c | 9 +++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)
Signature · 1 line
2.43.0

Read the cover letter in its thread