staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()grafted

rtw_action_frame_parse() takes a frame_len parameter but never
actually checks it before indexing into the frame body:

	const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);
	...
	c = frame_body[0];
	...
	a = frame_body[1];

frame_body already points 24 bytes (sizeof(struct
ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and
frame_body[1] requires frame_len >= 26. A management action frame
shorter than that (e.g. exactly 24 bytes, the minimum a malicious
peer can send) causes a 1-2 byte out-of-bounds read.

This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and
cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass
attacker/user-influenced frame buffers and lengths straight through.

Add the missing length check before frame_body is dereferenced.

Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 157 insertions, 0 deletions

diff --git a/include/net/sctp/tsnmap.h b/include/net/sctp/tsnmap.h
new file mode 100644
index 000000000..616ae0d49
--- /dev/null
+++ b/include/net/sctp/tsnmap.h
@@ -0,0 +1,157 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/* SCTP kernel implementation
+ * (C) Copyright IBM Corp. 2001, 2004
+ * Copyright (c) 1999-2000 Cisco, Inc.
+ * Copyright (c) 1999-2001 Motorola, Inc.
+ * Copyright (c) 2001 Intel Corp.
+ *
+ * This file is part of the SCTP kernel implementation
+ *
+ * These are the definitions needed for the tsnmap type.  The tsnmap is used
+ * to track out of order TSNs received.
+ *
+ * Please send any bug reports or fixes you make to the
+ * email address(es):
+ *    lksctp developers <linux-sctp@vger.kernel.org>
+ *
+ * Written or modified by:
+ *   Jon Grimm             <jgrimm@us.ibm.com>
+ *   La Monte H.P. Yarroll <piggy@acm.org>
+ *   Karl Knutson          <karl@athena.chicago.il.us>
+ *   Sridhar Samudrala     <sri@us.ibm.com>
+ */
+#include <net/sctp/constants.h>
+
+#ifndef __sctp_tsnmap_h__
+#define __sctp_tsnmap_h__
+
+/* RFC 2960 12.2 Parameters necessary per association (i.e. the TCB)
+ * Mapping  An array of bits or bytes indicating which out of
+ * Array    order TSN's have been received (relative to the
+ *          Last Rcvd TSN). If no gaps exist, i.e. no out of
+ *          order packets have been received, this array
+ *          will be set to all zero. This structure may be
+ *          in the form of a circular buffer or bit array.
+ */
+struct sctp_tsnmap {
+	/* This array counts the number of chunks with each TSN.
+	 * It points at one of the two buffers with which we will
+	 * ping-pong between.
+	 */
+	unsigned long *tsn_map;
+
+	/* This is the TSN at tsn_map[0].  */
+	__u32 base_tsn;
+
+	/* Last Rcvd   : This is the last TSN received in
+	 * TSN	       : sequence. This value is set initially by
+	 *             : taking the peer's Initial TSN, received in
+	 *             : the INIT or INIT ACK chunk, and subtracting
+	 *             : one from it.
+	 *
+	 * Throughout most of the specification this is called the
+	 * "Cumulative TSN ACK Point".  In this case, we
+	 * ignore the advice in 12.2 in favour of the term
+	 * used in the bulk of the text.
+	 */
+	__u32 cumulative_tsn_ack_point;
+
+	/* This is the highest TSN we've marked.  */
+	__u32 max_tsn_seen;
+
+	/* This is the minimum number of TSNs we can track.  This corresponds
+	 * to the size of tsn_map.   Note: the overflow_map allows us to
+	 * potentially track more than this quantity.
+	 */
+	__u16 len;
+
+	/* Data chunks pending receipt. used by SCTP_STATUS sockopt */
+	__u16 pending_data;
+
+	/* Record duplicate TSNs here.  We clear this after
+	 * every SACK.  Store up to SCTP_MAX_DUP_TSNS worth of
+	 * information.
+	 */
+	__u16 num_dup_tsns;
+	__be32 dup_tsns[SCTP_MAX_DUP_TSNS];
+};
+
+struct sctp_tsnmap_iter {
+	__u32 start;
+};
+
+/* Initialize a block of memory as a tsnmap.  */
+struct sctp_tsnmap *sctp_tsnmap_init(struct sctp_tsnmap *, __u16 len,
+				     __u32 initial_tsn, gfp_t gfp);
+
+void sctp_tsnmap_free(struct sctp_tsnmap *map);
+
+/* Test the tracking state of this TSN.
+ * Returns:
+ *   0 if the TSN has not yet been seen
+ *  >0 if the TSN has been seen (duplicate)
+ *  <0 if the TSN is invalid (too large to track)
+ */
+int sctp_tsnmap_check(const struct sctp_tsnmap *, __u32 tsn);
+
+/* Mark this TSN as seen.  */
+int sctp_tsnmap_mark(struct sctp_tsnmap *, __u32 tsn,
+		     struct sctp_transport *trans);
+
+/* Mark this TSN and all lower as seen. */
+void sctp_tsnmap_skip(struct sctp_tsnmap *map, __u32 tsn);
+
+/* Retrieve the Cumulative TSN ACK Point.  */
+static inline __u32 sctp_tsnmap_get_ctsn(const struct sctp_tsnmap *map)
+{
+	return map->cumulative_tsn_ack_point;
+}
+
+/* Retrieve the highest TSN we've seen.  */
+static inline __u32 sctp_tsnmap_get_max_tsn_seen(const struct sctp_tsnmap *map)
+{
+	return map->max_tsn_seen;
+}
+
+/* How many duplicate TSNs are stored? */
+static inline __u16 sctp_tsnmap_num_dups(struct sctp_tsnmap *map)
+{
+	return map->num_dup_tsns;
+}
+
+/* Return pointer to duplicate tsn array as needed by SACK. */
+static inline __be32 *sctp_tsnmap_get_dups(struct sctp_tsnmap *map)
+{
+	map->num_dup_tsns = 0;
+	return map->dup_tsns;
+}
+
+/* How many gap ack blocks do we have recorded? */
+__u16 sctp_tsnmap_num_gabs(struct sctp_tsnmap *map,
+			   struct sctp_gap_ack_block *gabs);
+
+/* Refresh the count on pending data. */
+__u16 sctp_tsnmap_pending(struct sctp_tsnmap *map);
+
+/* Is there a gap in the TSN map?  */
+static inline int sctp_tsnmap_has_gap(const struct sctp_tsnmap *map)
+{
+	return map->cumulative_tsn_ack_point != map->max_tsn_seen;
+}
+
+/* Mark a duplicate TSN.  Note:  limit the storage of duplicate TSN
+ * information.
+ */
+static inline void sctp_tsnmap_mark_dup(struct sctp_tsnmap *map, __u32 tsn)
+{
+	if (map->num_dup_tsns < SCTP_MAX_DUP_TSNS)
+		map->dup_tsns[map->num_dup_tsns++] = htonl(tsn);
+}
+
+/* Renege a TSN that was seen.  */
+void sctp_tsnmap_renege(struct sctp_tsnmap *, __u32 tsn);
+
+/* Is there a gap in the TSN map? */
+int sctp_tsnmap_has_gap(const struct sctp_tsnmap *);
+
+#endif /* __sctp_tsnmap_h__ */