staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()grafted

rtw_action_frame_parse() takes a frame_len parameter but never
actually checks it before indexing into the frame body:

	const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);
	...
	c = frame_body[0];
	...
	a = frame_body[1];

frame_body already points 24 bytes (sizeof(struct
ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and
frame_body[1] requires frame_len >= 26. A management action frame
shorter than that (e.g. exactly 24 bytes, the minimum a malicious
peer can send) causes a 1-2 byte out-of-bounds read.

This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and
cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass
attacker/user-influenced frame buffers and lengths straight through.

Add the missing length check before frame_body is dereferenced.

Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 204 insertions, 0 deletions

diff --git a/drivers/input/Kconfig b/drivers/input/Kconfig
new file mode 100644
index 000000000..88ecdf521
--- /dev/null
+++ b/drivers/input/Kconfig
@@ -0,0 +1,204 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Input device configuration
+#
+
+menu "Input device support"
+
+config INPUT
+	tristate "Generic input layer (needed for keyboard, mouse, ...)" if EXPERT
+	default y
+	help
+	  Say Y here if you have any input device (mouse, keyboard, tablet,
+	  joystick, steering wheel ...) connected to your system and want
+	  it to be available to applications. This includes standard PS/2
+	  keyboard and mouse.
+
+	  Say N here if you have a headless (no monitor, no keyboard) system.
+
+	  More information is available: <file:Documentation/input/input.rst>
+
+	  If unsure, say Y.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called input.
+
+if INPUT
+
+config INPUT_LEDS
+	tristate "Export input device LEDs in sysfs"
+	depends on LEDS_CLASS
+	default INPUT
+	help
+	  Say Y here if you would like to export LEDs on input devices
+	  as standard LED class devices in sysfs.
+
+	  If unsure, say Y.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called input-leds.
+
+config INPUT_FF_MEMLESS
+	tristate "Support for memoryless force-feedback devices"
+	help
+	  Say Y here if you have memoryless force-feedback input device
+	  such as Logitech WingMan Force 3D, ThrustMaster FireStorm Dual
+	  Power 2, or similar. You will also need to enable hardware-specific
+	  driver.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called ff-memless.
+
+config INPUT_SPARSEKMAP
+	tristate "Sparse keymap support library"
+	help
+	  Say Y here if you are using a driver for an input
+	  device that uses sparse keymap. This option is only
+	  useful for out-of-tree drivers since in-tree drivers
+	  select it automatically.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called sparse-keymap.
+
+config INPUT_MATRIXKMAP
+	tristate "Matrix keymap support library"
+	help
+	  Say Y here if you are using a driver for an input
+	  device that uses matrix keymap. This option is only
+	  useful for out-of-tree drivers since in-tree drivers
+	  select it automatically.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called matrix-keymap.
+
+config INPUT_VIVALDIFMAP
+	tristate
+	help
+	  ChromeOS Vivaldi keymap support library. This is a hidden
+	  option so that drivers can use common code to parse and
+	  expose the vivaldi function row keymap.
+
+comment "Userland interfaces"
+
+config INPUT_MOUSEDEV
+	tristate "Mouse interface"
+	help
+	  Say Y here if you want your mouse to be accessible as char devices
+	  13:32+ - /dev/input/mouseX and 13:63 - /dev/input/mice as an
+	  emulated IntelliMouse Explorer PS/2 mouse. That way, all user space
+	  programs (including SVGAlib, GPM and X) will be able to use your
+	  mouse.
+
+	  If unsure, say Y.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called mousedev.
+
+config INPUT_MOUSEDEV_PSAUX
+	bool "Provide legacy /dev/psaux device"
+	depends on INPUT_MOUSEDEV
+	help
+	  Say Y here if you want your mouse also be accessible as char device
+	  10:1 - /dev/psaux. The data available through /dev/psaux is exactly
+	  the same as the data from /dev/input/mice.
+
+	  If unsure, say Y.
+
+config INPUT_MOUSEDEV_SCREEN_X
+	int "Horizontal screen resolution"
+	depends on INPUT_MOUSEDEV
+	default "1024"
+	help
+	  If you're using a digitizer, or a graphic tablet, and want to use
+	  it as a mouse then the mousedev driver needs to know the X window
+	  screen resolution you are using to correctly scale the data. If
+	  you're not using a digitizer, this value is ignored.
+
+config INPUT_MOUSEDEV_SCREEN_Y
+	int "Vertical screen resolution"
+	depends on INPUT_MOUSEDEV
+	default "768"
+	help
+	  If you're using a digitizer, or a graphic tablet, and want to use
+	  it as a mouse then the mousedev driver needs to know the X window
+	  screen resolution you are using to correctly scale the data. If
+	  you're not using a digitizer, this value is ignored.
+
+config INPUT_JOYDEV
+	tristate "Joystick interface"
+	help
+	  Say Y here if you want your joystick or gamepad to be
+	  accessible as char device 13:0+ - /dev/input/jsX device.
+
+	  If unsure, say Y.
+
+	  More information is available: <file:Documentation/input/joydev/joystick.rst>
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called joydev.
+
+config INPUT_EVDEV
+	tristate "Event interface"
+	help
+	  Say Y here if you want your input device events be accessible
+	  under char device 13:64+ - /dev/input/eventX in a generic way.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called evdev.
+
+config INPUT_KUNIT_TEST
+	tristate "KUnit tests for Input" if !KUNIT_ALL_TESTS
+	depends on INPUT && KUNIT
+	default KUNIT_ALL_TESTS
+	help
+	  Say Y here if you want to build the KUnit tests for the input
+	  subsystem.
+
+	  If in doubt, say "N".
+
+config INPUT_APMPOWER
+	tristate "Input Power Event -> APM Bridge" if EXPERT
+	depends on INPUT && APM_EMULATION
+	help
+	  Say Y here if you want suspend key events to trigger a user
+	  requested suspend through APM. This is useful on embedded
+	  systems where such behaviour is desired without userspace
+	  interaction. If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called apm-power.
+
+comment "Input Device Drivers"
+
+source "drivers/input/keyboard/Kconfig"
+
+source "drivers/input/mouse/Kconfig"
+
+source "drivers/input/joystick/Kconfig"
+
+source "drivers/input/tablet/Kconfig"
+
+source "drivers/input/touchscreen/Kconfig"
+
+source "drivers/input/misc/Kconfig"
+
+source "drivers/input/rmi4/Kconfig"
+
+endif
+
+menu "Hardware I/O ports"
+
+source "drivers/input/serio/Kconfig"
+
+source "drivers/input/gameport/Kconfig"
+
+endmenu
+
+endmenu
+