staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()grafted

rtw_action_frame_parse() takes a frame_len parameter but never
actually checks it before indexing into the frame body:

	const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);
	...
	c = frame_body[0];
	...
	a = frame_body[1];

frame_body already points 24 bytes (sizeof(struct
ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and
frame_body[1] requires frame_len >= 26. A management action frame
shorter than that (e.g. exactly 24 bytes, the minimum a malicious
peer can send) causes a 1-2 byte out-of-bounds read.

This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and
cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass
attacker/user-influenced frame buffers and lengths straight through.

Add the missing length check before frame_body is dereferenced.

Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 110 insertions, 0 deletions

diff --git a/rust/syn/ident.rs b/rust/syn/ident.rs
new file mode 100644
index 000000000..03ccebf9c
--- /dev/null
+++ b/rust/syn/ident.rs
@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+#[cfg(feature = "parsing")]
+use crate::lookahead;
+
+pub use proc_macro2::Ident;
+
+#[cfg(feature = "parsing")]
+pub_if_not_doc! {
+    #[doc(hidden)]
+    #[allow(non_snake_case)]
+    pub fn Ident(marker: lookahead::TokenMarker) -> Ident {
+        match marker {}
+    }
+}
+
+macro_rules! ident_from_token {
+    ($token:ident) => {
+        impl From<Token![$token]> for Ident {
+            fn from(token: Token![$token]) -> Ident {
+                Ident::new(stringify!($token), token.span)
+            }
+        }
+    };
+}
+
+ident_from_token!(self);
+ident_from_token!(Self);
+ident_from_token!(super);
+ident_from_token!(crate);
+ident_from_token!(extern);
+
+impl From<Token![_]> for Ident {
+    fn from(token: Token![_]) -> Ident {
+        Ident::new("_", token.span)
+    }
+}
+
+pub(crate) fn xid_ok(symbol: &str) -> bool {
+    let mut chars = symbol.chars();
+    let first = chars.next().unwrap();
+    if !(first == '_' || first.is_ascii_alphabetic()) {
+        return false;
+    }
+    for ch in chars {
+        if !(ch == '_' || ch.is_ascii_alphanumeric()) {
+            return false;
+        }
+    }
+    true
+}
+
+#[cfg(feature = "parsing")]
+mod parsing {
+    use crate::buffer::Cursor;
+    use crate::error::Result;
+    use crate::parse::{Parse, ParseStream};
+    use crate::token::Token;
+    use proc_macro2::Ident;
+
+    fn accept_as_ident(ident: &Ident) -> bool {
+        match ident.to_string().as_str() {
+            "_" |
+            // Based on https://doc.rust-lang.org/1.65.0/reference/keywords.html
+            "abstract" | "as" | "async" | "await" | "become" | "box" | "break" |
+            "const" | "continue" | "crate" | "do" | "dyn" | "else" | "enum" |
+            "extern" | "false" | "final" | "fn" | "for" | "if" | "impl" | "in" |
+            "let" | "loop" | "macro" | "match" | "mod" | "move" | "mut" |
+            "override" | "priv" | "pub" | "ref" | "return" | "Self" | "self" |
+            "static" | "struct" | "super" | "trait" | "true" | "try" | "type" |
+            "typeof" | "unsafe" | "unsized" | "use" | "virtual" | "where" |
+            "while" | "yield" => false,
+            _ => true,
+        }
+    }
+
+    #[cfg_attr(docsrs, doc(cfg(feature = "parsing")))]
+    impl Parse for Ident {
+        fn parse(input: ParseStream) -> Result<Self> {
+            input.step(|cursor| {
+                if let Some((ident, rest)) = cursor.ident() {
+                    if accept_as_ident(&ident) {
+                        Ok((ident, rest))
+                    } else {
+                        Err(cursor.error(format_args!(
+                            "expected identifier, found keyword `{}`",
+                            ident,
+                        )))
+                    }
+                } else {
+                    Err(cursor.error("expected identifier"))
+                }
+            })
+        }
+    }
+
+    impl Token for Ident {
+        fn peek(cursor: Cursor) -> bool {
+            if let Some((ident, _rest)) = cursor.ident() {
+                accept_as_ident(&ident)
+            } else {
+                false
+            }
+        }
+
+        fn display() -> &'static str {
+            "identifier"
+        }
+    }
+}