linux-kernel - Re: [PATCH v2 4/5] staging: rtl8723bs: fix out-of-bounds check in rtw_restruct_wmm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CADRnA92+uALjFwg1V2FF0SwSvGaCDanF8bHij0bY_q17wLgF8w@mail.gmail.com>
Date: Fri, 30 Jan 2026 06:56:16 +0100
From: Luka Gejak <lukagejak5@...il.com>
To: Greg KH <gregkh@...uxfoundation.org>
Cc: straube.linux@...il.com, dan.carpenter@...aro.org, 
	linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 4/5] staging: rtl8723bs: fix out-of-bounds check in rtw_restruct_wmm_ie

On Thu, Jan 29, 2026, Greg Kroah-Hartman wrote:
> Is this really a bugfix? if so, it needs to go first, and be tagged for
> stable trees.

Yes, it fixes a potential out-of-bounds read. I have moved it to the
beginning of the series (1/5) in v5 and added the Cc: stable tag.

> Also, why invert the i+5 check?

I moved the length check to the start of the condition to ensure
in_ie[i+5] is not accessed before the buffer bounds are verified.

> And the memcmp check is now messier than the original.
> Very odd indentation :(

Understood. For v3/v4, I have dropped the memcmp change entirely,
reverted to the original byte-by-byte comparison style, and
fixed the indentation.
IMPORTANT: in v3 I haven't deleted variable i that causes error
(-Wunused-variable) upon compiling. I have fixed that in v4
which was sent on Jan 29, 2026. I would also like to address
label issue you mentioned. If you consider it necessary I will
remove the security fix from name/label and submit v5 with such
change. I will be able to submit v5 if requested at about 13:00 UTC.

Thanks for the review,
Luka

On Fri, Jan 30, 2026 at 6:26 AM Greg KH <gregkh@...uxfoundation.org> wrote:
>
> On Thu, Jan 29, 2026 at 04:35:29PM +0100, Luka Gejak wrote:
> > Subject: Re: [PATCH v2 4/5] staging: rtl8723bs: fix out-of-bounds check in
> > rtw_restruct_wmm_ie
> > On Thu, Jan 29, 2026 at 02:23:51PM +0100, Greg Kroah-Hartman wrote:
>
> <snip>
>
> something went wrong with your reply, sorry, it was in html format and
> all mushed together and not in the in-line response format, which is
> rejected by the public mailing list.  I'll be glad to respond if you
> resend it in text-only and interleaved.
>
> thanks,
>
> greg k-h