staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()grafted

rtw_action_frame_parse() takes a frame_len parameter but never
actually checks it before indexing into the frame body:

	const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);
	...
	c = frame_body[0];
	...
	a = frame_body[1];

frame_body already points 24 bytes (sizeof(struct
ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and
frame_body[1] requires frame_len >= 26. A management action frame
shorter than that (e.g. exactly 24 bytes, the minimum a malicious
peer can send) causes a 1-2 byte out-of-bounds read.

This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and
cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass
attacker/user-influenced frame buffers and lengths straight through.

Add the missing length check before frame_body is dereferenced.

Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 106 insertions, 0 deletions

diff --git a/fs/zonefs/trace.h b/fs/zonefs/trace.h
new file mode 100644
index 000000000..7315a72ca
--- /dev/null
+++ b/fs/zonefs/trace.h
@@ -0,0 +1,106 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * zonefs filesystem driver tracepoints.
+ *
+ * Copyright (C) 2021 Western Digital Corporation or its affiliates.
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM zonefs
+
+#if !defined(_TRACE_ZONEFS_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_ZONEFS_H
+
+#include <linux/tracepoint.h>
+#include <linux/trace_seq.h>
+#include <linux/blkdev.h>
+
+#include "zonefs.h"
+
+#define show_dev(dev) MAJOR(dev), MINOR(dev)
+
+TRACE_EVENT(zonefs_zone_mgmt,
+	    TP_PROTO(struct super_block *sb, struct zonefs_zone *z,
+		     enum req_op op),
+	    TP_ARGS(sb, z, op),
+	    TP_STRUCT__entry(
+			     __field(dev_t, dev)
+			     __field(u64, ino)
+			     __field(enum req_op, op)
+			     __field(sector_t, sector)
+			     __field(sector_t, nr_sectors)
+	    ),
+	    TP_fast_assign(
+			   __entry->dev = sb->s_dev;
+			   __entry->ino =
+				z->z_sector >> ZONEFS_SB(sb)->s_zone_sectors_shift;
+			   __entry->op = op;
+			   __entry->sector = z->z_sector;
+			   __entry->nr_sectors = z->z_size >> SECTOR_SHIFT;
+	    ),
+	    TP_printk("bdev=(%d,%d), ino=%llu op=%s, sector=%llu, nr_sectors=%llu",
+		      show_dev(__entry->dev), __entry->ino,
+		      blk_op_str(__entry->op), __entry->sector,
+		      __entry->nr_sectors
+	    )
+);
+
+TRACE_EVENT(zonefs_file_dio_append,
+	    TP_PROTO(struct inode *inode, ssize_t size, ssize_t ret),
+	    TP_ARGS(inode, size, ret),
+	    TP_STRUCT__entry(
+			     __field(dev_t, dev)
+			     __field(u64, ino)
+			     __field(sector_t, sector)
+			     __field(ssize_t, size)
+			     __field(loff_t, wpoffset)
+			     __field(ssize_t, ret)
+	    ),
+	    TP_fast_assign(
+			   __entry->dev = inode->i_sb->s_dev;
+			   __entry->ino = inode->i_ino;
+			   __entry->sector = zonefs_inode_zone(inode)->z_sector;
+			   __entry->size = size;
+			   __entry->wpoffset =
+				zonefs_inode_zone(inode)->z_wpoffset;
+			   __entry->ret = ret;
+	    ),
+	    TP_printk("bdev=(%d, %d), ino=%llu, sector=%llu, size=%zu, wpoffset=%llu, ret=%zu",
+		      show_dev(__entry->dev), __entry->ino,
+		      __entry->sector, __entry->size, __entry->wpoffset,
+		      __entry->ret
+	    )
+);
+
+TRACE_EVENT(zonefs_iomap_begin,
+	    TP_PROTO(struct inode *inode, struct iomap *iomap),
+	    TP_ARGS(inode, iomap),
+	    TP_STRUCT__entry(
+			     __field(dev_t, dev)
+			     __field(u64, ino)
+			     __field(u64, addr)
+			     __field(loff_t, offset)
+			     __field(u64, length)
+	    ),
+	    TP_fast_assign(
+			   __entry->dev = inode->i_sb->s_dev;
+			   __entry->ino = inode->i_ino;
+			   __entry->addr = iomap->addr;
+			   __entry->offset = iomap->offset;
+			   __entry->length = iomap->length;
+	    ),
+	    TP_printk("bdev=(%d,%d), ino=%llu, addr=%llu, offset=%llu, length=%llu",
+		      show_dev(__entry->dev), __entry->ino,
+		      __entry->addr, __entry->offset, __entry->length
+	    )
+);
+
+#endif /* _TRACE_ZONEFS_H */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE trace
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>