staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()grafted

rtw_action_frame_parse() takes a frame_len parameter but never
actually checks it before indexing into the frame body:

	const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);
	...
	c = frame_body[0];
	...
	a = frame_body[1];

frame_body already points 24 bytes (sizeof(struct
ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and
frame_body[1] requires frame_len >= 26. A management action frame
shorter than that (e.g. exactly 24 bytes, the minimum a malicious
peer can send) causes a 1-2 byte out-of-bounds read.

This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and
cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass
attacker/user-influenced frame buffers and lengths straight through.

Add the missing length check before frame_body is dereferenced.

Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 124 insertions, 0 deletions

diff --git a/drivers/accessibility/speakup/buffers.c b/drivers/accessibility/speakup/buffers.c
new file mode 100644
index 000000000..1371ced2f
--- /dev/null
+++ b/drivers/accessibility/speakup/buffers.c
@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/console.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+
+#include "speakup.h"
+#include "spk_priv.h"
+
+#define SYNTH_BUF_SIZE 8192	/* currently 8K bytes */
+
+static u16 synth_buffer[SYNTH_BUF_SIZE];	/* guess what this is for! */
+static u16 *buff_in = synth_buffer;
+static u16 *buff_out = synth_buffer;
+static u16 *buffer_end = synth_buffer + SYNTH_BUF_SIZE - 1;
+
+/* These try to throttle applications by stopping the TTYs
+ * Note: we need to make sure that we will restart them eventually, which is
+ * usually not possible to do from the notifiers. TODO: it should be possible
+ * starting from linux 2.6.26.
+ *
+ * So we only stop when we know alive == 1 (else we discard the data anyway),
+ * and the alive synth will eventually call start_ttys from the thread context.
+ */
+void speakup_start_ttys(void)
+{
+	int i;
+
+	for (i = 0; i < MAX_NR_CONSOLES; i++) {
+		if (speakup_console[i] && speakup_console[i]->tty_stopped)
+			continue;
+		if (vc_cons[i].d && vc_cons[i].d->port.tty)
+			start_tty(vc_cons[i].d->port.tty);
+	}
+}
+EXPORT_SYMBOL_GPL(speakup_start_ttys);
+
+static void speakup_stop_ttys(void)
+{
+	int i;
+
+	for (i = 0; i < MAX_NR_CONSOLES; i++)
+		if (vc_cons[i].d && vc_cons[i].d->port.tty)
+			stop_tty(vc_cons[i].d->port.tty);
+}
+
+static int synth_buffer_free(void)
+{
+	int chars_free;
+
+	if (buff_in >= buff_out)
+		chars_free = SYNTH_BUF_SIZE - (buff_in - buff_out);
+	else
+		chars_free = buff_out - buff_in;
+	return chars_free;
+}
+
+int synth_buffer_empty(void)
+{
+	return (buff_in == buff_out);
+}
+EXPORT_SYMBOL_GPL(synth_buffer_empty);
+
+void synth_buffer_add(u16 ch)
+{
+	if (!synth->alive) {
+		/* This makes sure that we won't stop TTYs if there is no synth
+		 * to restart them
+		 */
+		return;
+	}
+	if (synth_buffer_free() <= 100) {
+		synth_start();
+		speakup_stop_ttys();
+	}
+	if (synth_buffer_free() <= 1)
+		return;
+	*buff_in++ = ch;
+	if (buff_in > buffer_end)
+		buff_in = synth_buffer;
+	/* We have written something to the speech synthesis, so we are not
+	 * paused any more.
+	 */
+	spk_paused = false;
+}
+
+u16 synth_buffer_getc(void)
+{
+	u16 ch;
+
+	if (buff_out == buff_in)
+		return 0;
+	ch = *buff_out++;
+	if (buff_out > buffer_end)
+		buff_out = synth_buffer;
+	return ch;
+}
+EXPORT_SYMBOL_GPL(synth_buffer_getc);
+
+u16 synth_buffer_peek(void)
+{
+	if (buff_out == buff_in)
+		return 0;
+	return *buff_out;
+}
+EXPORT_SYMBOL_GPL(synth_buffer_peek);
+
+void synth_buffer_skip_nonlatin1(void)
+{
+	while (buff_out != buff_in) {
+		if (*buff_out < 0x100)
+			return;
+		buff_out++;
+		if (buff_out > buffer_end)
+			buff_out = synth_buffer;
+	}
+}
+EXPORT_SYMBOL_GPL(synth_buffer_skip_nonlatin1);
+
+void synth_buffer_clear(void)
+{
+	buff_in = synth_buffer;
+	buff_out = synth_buffer;
+}
+EXPORT_SYMBOL_GPL(synth_buffer_clear);