From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- arch/powerpc/boot/simpleboot.c | 87 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 arch/powerpc/boot/simpleboot.c (limited to 'arch/powerpc/boot/simpleboot.c') diff --git a/arch/powerpc/boot/simpleboot.c b/arch/powerpc/boot/simpleboot.c new file mode 100644 index 000000000..27591df41 --- /dev/null +++ b/arch/powerpc/boot/simpleboot.c @@ -0,0 +1,87 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * The simple platform -- for booting when firmware doesn't supply a device + * tree or any platform configuration information. + * All data is extracted from an embedded device tree + * blob. + * + * Authors: Scott Wood + * Grant Likely + * + * Copyright (c) 2007 Freescale Semiconductor, Inc. + * Copyright (c) 2008 Secret Lab Technologies Ltd. + */ + +#include "ops.h" +#include "types.h" +#include "io.h" +#include "stdio.h" +#include + +BSS_STACK(4*1024); + +extern int platform_specific_init(void) __attribute__((weak)); + +void platform_init(unsigned long r3, unsigned long r4, unsigned long r5, + unsigned long r6, unsigned long r7) +{ + const u32 *na, *ns, *reg, *timebase; + u64 memsize64; + int node, size, i; + + /* Make sure FDT blob is sane */ + if (fdt_check_header(_dtb_start) != 0) + fatal("Invalid device tree blob\n"); + + /* Find the #address-cells and #size-cells properties */ + node = fdt_path_offset(_dtb_start, "/"); + if (node < 0) + fatal("Cannot find root node\n"); + na = fdt_getprop(_dtb_start, node, "#address-cells", &size); + if (!na || (size != 4)) + fatal("Cannot find #address-cells property"); + ns = fdt_getprop(_dtb_start, node, "#size-cells", &size); + if (!ns || (size != 4)) + fatal("Cannot find #size-cells property"); + + /* Find the memory range */ + node = fdt_node_offset_by_prop_value(_dtb_start, -1, "device_type", + "memory", sizeof("memory")); + if (node < 0) + fatal("Cannot find memory node\n"); + reg = fdt_getprop(_dtb_start, node, "reg", &size); + if (size < (*na+*ns) * sizeof(u32)) + fatal("cannot get memory range\n"); + + /* Only interested in memory based at 0 */ + for (i = 0; i < *na; i++) + if (*reg++ != 0) + fatal("Memory range is not based at address 0\n"); + + /* get the memsize and truncate it to under 4G on 32 bit machines */ + memsize64 = 0; + for (i = 0; i < *ns; i++) + memsize64 = (memsize64 << 32) | *reg++; + if (sizeof(void *) == 4 && memsize64 >= 0x100000000ULL) + memsize64 = 0xffffffff; + + /* finally, setup the timebase */ + node = fdt_node_offset_by_prop_value(_dtb_start, -1, "device_type", + "cpu", sizeof("cpu")); + if (node < 0) + fatal("Cannot find cpu node\n"); + timebase = fdt_getprop(_dtb_start, node, "timebase-frequency", &size); + if (timebase && (size == 4)) + timebase_period_ns = 1000000000 / *timebase; + + /* Now we have the memory size; initialize the heap */ + simple_alloc_init(_end, memsize64 - (unsigned long)_end, 32, 64); + + /* prepare the device tree and find the console */ + fdt_init(_dtb_start); + + if (platform_specific_init) + platform_specific_init(); + + serial_console_init(); +} -- cgit v1.3.1