staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()grafted

rtw_action_frame_parse() takes a frame_len parameter but never
actually checks it before indexing into the frame body:

	const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);
	...
	c = frame_body[0];
	...
	a = frame_body[1];

frame_body already points 24 bytes (sizeof(struct
ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and
frame_body[1] requires frame_len >= 26. A management action frame
shorter than that (e.g. exactly 24 bytes, the minimum a malicious
peer can send) causes a 1-2 byte out-of-bounds read.

This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and
cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass
attacker/user-influenced frame buffers and lengths straight through.

Add the missing length check before frame_body is dereferenced.

Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 160 insertions, 0 deletions

diff --git a/tools/perf/tests/kallsyms-split.c b/tools/perf/tests/kallsyms-split.c
new file mode 100644
index 000000000..244daa01b
--- /dev/null
+++ b/tools/perf/tests/kallsyms-split.c
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/compiler.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include "util/dso.h"
+#include "util/map.h"
+#include "util/symbol.h"
+#include "util/debug.h"
+#include "util/machine.h"
+#include "tests.h"
+
+/*
+ * This test is to check whether a bad symbol in a module won't split kallsyms maps.
+ * The main_symbol[1-3] should belong to the main [kernel.kallsyms] map even if the
+ * bad_symbol from the module is found in the middle.
+ */
+static char root_template[] = "/tmp/perf-test.XXXXXX";
+static char *root_dir;
+
+static const char proc_version[] = "Linux version X.Y.Z (just for perf test)\n";
+static const char proc_modules[] = "module 4096 1 - Live 0xffffffffcd000000\n";
+static const char proc_kallsyms[] =
+	"ffffffffab200000 T _stext\n"
+	"ffffffffab200010 T good_symbol\n"
+	"ffffffffab200020 t bad_symbol\n"
+	"ffffffffab200030 t main_symbol1\n"
+	"ffffffffab200040 t main_symbol2\n"
+	"ffffffffab200050 t main_symbol3\n"
+	"ffffffffab200060 T _etext\n"
+	"ffffffffcd000000 T start_module\t[module]\n"
+	"ffffffffab200020 u bad_symbol\t[module]\n"
+	"ffffffffcd000040 T end_module\t[module]\n";
+
+static struct {
+	const char *name;
+	const char *contents;
+	long len;
+} proc_files[] = {
+	{ "version", proc_version, sizeof(proc_version) - 1 },
+	{ "modules", proc_modules, sizeof(proc_modules) - 1 },
+	{ "kallsyms", proc_kallsyms, sizeof(proc_kallsyms) - 1 },
+};
+
+static void remove_proc_dir(int sig __maybe_unused)
+{
+	char buf[128];
+
+	if (root_dir == NULL)
+		return;
+
+	for (unsigned i = 0; i < ARRAY_SIZE(proc_files); i++) {
+		scnprintf(buf, sizeof(buf), "%s/proc/%s", root_dir, proc_files[i].name);
+		remove(buf);
+	}
+
+	scnprintf(buf, sizeof(buf), "%s/proc", root_dir);
+	rmdir(buf);
+
+	rmdir(root_dir);
+	root_dir = NULL;
+}
+
+static int create_proc_dir(void)
+{
+	char buf[128];
+
+	root_dir = mkdtemp(root_template);
+	if (root_dir == NULL)
+		return -1;
+
+	scnprintf(buf, sizeof(buf), "%s/proc", root_dir);
+	if (mkdir(buf, 0700) < 0)
+		goto err;
+
+	for (unsigned i = 0; i < ARRAY_SIZE(proc_files); i++) {
+		int fd, len;
+
+		scnprintf(buf, sizeof(buf), "%s/proc/%s", root_dir, proc_files[i].name);
+		fd = open(buf, O_RDWR | O_CREAT, 0600);
+		if (fd < 0)
+			goto err;
+
+		len = write(fd, proc_files[i].contents, proc_files[i].len);
+		close(fd);
+		if (len != proc_files[i].len)
+			goto err;
+	}
+	return 0;
+
+err:
+	remove_proc_dir(0);
+	return -1;
+}
+
+static int test__kallsyms_split(struct test_suite *test __maybe_unused,
+				int subtest __maybe_unused)
+{
+	struct machine m = { 0 };
+	struct map *map = NULL;
+	int ret = TEST_FAIL;
+
+	pr_debug("try to create fake root directory\n");
+	if (create_proc_dir() < 0) {
+		pr_debug("SKIP: cannot create a fake root directory\n");
+		return TEST_SKIP;
+	}
+
+	signal(SIGINT, remove_proc_dir);
+	signal(SIGPIPE, remove_proc_dir);
+	signal(SIGSEGV, remove_proc_dir);
+	signal(SIGTERM, remove_proc_dir);
+
+	pr_debug("create kernel maps from the fake root directory\n");
+	if (machine__init(&m, root_dir, HOST_KERNEL_ID)) {
+		pr_debug("FAIL: failed to init machine\n");
+		goto out;
+	}
+	if (machine__create_kernel_maps(&m) < 0) {
+		pr_debug("FAIL: failed to create kernel maps\n");
+		goto out;
+	}
+
+	/* force to use /proc/kallsyms */
+	symbol_conf.ignore_vmlinux = true;
+	symbol_conf.ignore_vmlinux_buildid = true;
+	symbol_conf.allow_aliases = true;
+
+	if (map__load(machine__kernel_map(&m)) < 0) {
+		pr_debug("FAIL: failed to load kallsyms\n");
+		goto out;
+	}
+
+	pr_debug("kernel map loaded - check symbol and map\n");
+	if (maps__nr_maps(machine__kernel_maps(&m)) != 2) {
+		pr_debug("FAIL: it should have the kernel and a module, but has %u maps\n",
+			 maps__nr_maps(machine__kernel_maps(&m)));
+		goto out;
+	}
+
+	if (machine__find_kernel_symbol_by_name(&m, "main_symbol3", &map) == NULL) {
+		pr_debug("FAIL: failed to find a symbol\n");
+		goto out;
+	}
+
+	if (!RC_CHK_EQUAL(map, machine__kernel_map(&m))) {
+		pr_debug("FAIL: the symbol is not in the kernel map\n");
+		goto out;
+	}
+	ret = TEST_OK;
+
+out:
+	map__put(map);
+	remove_proc_dir(0);
+	machine__exit(&m);
+	return ret;
+}
+
+DEFINE_SUITE("split kallsyms", kallsyms_split);