staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()grafted

rtw_action_frame_parse() takes a frame_len parameter but never
actually checks it before indexing into the frame body:

	const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);
	...
	c = frame_body[0];
	...
	a = frame_body[1];

frame_body already points 24 bytes (sizeof(struct
ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and
frame_body[1] requires frame_len >= 26. A management action frame
shorter than that (e.g. exactly 24 bytes, the minimum a malicious
peer can send) causes a 1-2 byte out-of-bounds read.

This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and
cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass
attacker/user-influenced frame buffers and lengths straight through.

Add the missing length check before frame_body is dereferenced.

Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 79 insertions, 0 deletions

diff --git a/include/video/kyro.h b/include/video/kyro.h
new file mode 100644
index 000000000..418eef6c5
--- /dev/null
+++ b/include/video/kyro.h
@@ -0,0 +1,79 @@
+/*
+ *  linux/drivers/video/kyro/kryo.h
+ *
+ *  Copyright (C) 2002 STMicroelectronics
+ *  Copyright (C) 2004 Paul Mundt
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive
+ * for more details.
+ */
+
+#ifndef _KYRO_H
+#define _KYRO_H
+
+struct kyrofb_info {
+	void __iomem *regbase;
+
+	u32 palette[16];
+	u32 HTot;	/* Hor Total Time    */
+	u32 HFP;	/* Hor Front Porch   */
+	u32 HST;	/* Hor Sync Time     */
+	u32 HBP;	/* Hor Back Porch    */
+	s32 HSP;		/* Hor Sync Polarity */
+	u32 VTot;	/* Ver Total Time    */
+	u32 VFP;	/* Ver Front Porch   */
+	u32 VST;	/* Ver Sync Time     */
+	u32 VBP;	/* Ver Back Porch    */
+	s32 VSP;		/* Ver Sync Polarity */
+	u32 XRES;	/* X Resolution      */
+	u32 YRES;	/* Y Resolution      */
+	u32 VFREQ;	/* Ver Frequency     */
+	u32 PIXCLK;	/* Pixel Clock       */
+	u32 HCLK;	/* Hor Clock         */
+
+	/* Useful to hold depth here for Linux */
+	u8 PIXDEPTH;
+
+	int wc_cookie;
+};
+
+/*
+ * benedict.gaster@superh.com
+ * Added the follow IOCTLS for the creation of overlay services...
+ */
+#define KYRO_IOC_MAGIC 'k'
+
+#define KYRO_IOCTL_OVERLAY_CREATE       _IO(KYRO_IOC_MAGIC, 0)
+#define KYRO_IOCTL_OVERLAY_VIEWPORT_SET _IO(KYRO_IOC_MAGIC, 1)
+#define KYRO_IOCTL_SET_VIDEO_MODE       _IO(KYRO_IOC_MAGIC, 2)
+#define KYRO_IOCTL_UVSTRIDE             _IO(KYRO_IOC_MAGIC, 3)
+#define KYRO_IOCTL_OVERLAY_OFFSET       _IO(KYRO_IOC_MAGIC, 4)
+#define KYRO_IOCTL_STRIDE               _IO(KYRO_IOC_MAGIC, 5)
+
+/*
+ * The follow 3 structures are used to pass data from user space into the kernel
+ * for the creation of overlay surfaces and setting the video mode.
+ */
+typedef struct _OVERLAY_CREATE {
+	u32 ulWidth;
+	u32 ulHeight;
+	int bLinear;
+} overlay_create;
+
+typedef struct _OVERLAY_VIEWPORT_SET {
+	u32 xOrgin;
+	u32 yOrgin;
+	u32 xSize;
+	u32 ySize;
+} overlay_viewport_set;
+
+typedef struct _SET_VIDEO_MODE {
+	u32 ulWidth;
+	u32 ulHeight;
+	u32 ulScan;
+	u8 displayDepth;
+	int bLinear;
+} set_video_mode;
+
+#endif /* _KYRO_H */