staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

Two IE parsing loops are missing the header bounds checks before they
dereference pIE->length:

 - issue_assocreq() walks pmlmeinfo->network.ies to build the
   association request. If the stored IE data ends with only an
   element_id byte and no length byte, pIE->length is read one byte
   past the end of the buffer.

 - join_cmd_hdl() walks pnetwork->ies during station join and has
   the same problem under the same conditions.

Both buffers are filled from AP beacon and probe-response frames, so a
malicious AP that sends a truncated final IE can trigger the issue.

Apply the two-guard pattern established in update_beacon_info():
  1. Break if fewer than sizeof(*pIE) bytes remain.
  2. Break if the IE's declared data extends past the buffer end.

Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-3-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
index 7198be79500080f08eb5e901d1ad0c702d3f12a2..70e864cd530d59c3da85969276b1f017013cee72 100644 (file)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -2861,7 +2861,11 @@ void issue_assocreq(struct adapter *padapter)
 
        /* vendor specific IE, such as WPA, WMM, WPS */
        for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.ie_length;) {
+               if (i + sizeof(*pIE) > pmlmeinfo->network.ie_length)
+                       break;
                pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i);
+               if (i + sizeof(*pIE) + pIE->length > pmlmeinfo->network.ie_length)
+                       break;
 
                switch (pIE->element_id) {
                case WLAN_EID_VENDOR_SPECIFIC:
@@ -5189,7 +5193,11 @@ u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
 
        /* sizeof(struct ndis_802_11_fix_ie) */
        for (i = _FIXED_IE_LENGTH_; i < pnetwork->ie_length;) {
+               if (i + sizeof(*pIE) > pnetwork->ie_length)
+                       break;
                pIE = (struct ndis_80211_var_ie *)(pnetwork->ies + i);
+               if (i + sizeof(*pIE) + pIE->length > pnetwork->ie_length)
+                       break;
 
                switch (pIE->element_id) {
                case WLAN_EID_VENDOR_SPECIFIC:/* Get WMM IE. */