From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- arch/xtensa/boot/boot-elf/.gitignore | 2 + arch/xtensa/boot/boot-elf/Makefile | 30 +++++++++++++ arch/xtensa/boot/boot-elf/boot.lds.S | 40 ++++++++++++++++++ arch/xtensa/boot/boot-elf/bootstrap.S | 79 +++++++++++++++++++++++++++++++++++ 4 files changed, 151 insertions(+) create mode 100644 arch/xtensa/boot/boot-elf/.gitignore create mode 100644 arch/xtensa/boot/boot-elf/Makefile create mode 100644 arch/xtensa/boot/boot-elf/boot.lds.S create mode 100644 arch/xtensa/boot/boot-elf/bootstrap.S (limited to 'arch/xtensa/boot/boot-elf') diff --git a/arch/xtensa/boot/boot-elf/.gitignore b/arch/xtensa/boot/boot-elf/.gitignore new file mode 100644 index 000000000..747340450 --- /dev/null +++ b/arch/xtensa/boot/boot-elf/.gitignore @@ -0,0 +1,2 @@ +# SPDX-License-Identifier: GPL-2.0-only +boot.lds diff --git a/arch/xtensa/boot/boot-elf/Makefile b/arch/xtensa/boot/boot-elf/Makefile new file mode 100644 index 000000000..faec20029 --- /dev/null +++ b/arch/xtensa/boot/boot-elf/Makefile @@ -0,0 +1,30 @@ +# +# This file is subject to the terms and conditions of the GNU General Public +# License. See the file "COPYING" in the main directory of this archive +# for more details. +# + +OBJCOPY_ARGS := -O $(if $(CONFIG_CPU_BIG_ENDIAN),elf32-xtensa-be,elf32-xtensa-le) + +CPPFLAGS_boot.lds += -P -C +KBUILD_AFLAGS += -mtext-section-literals + +boot-y := bootstrap.o +targets += $(boot-y) boot.lds + +OBJS := $(addprefix $(obj)/,$(boot-y)) + +$(obj)/Image.o: $(obj)/../vmlinux.bin $(OBJS) + $(Q)$(OBJCOPY) $(OBJCOPY_ARGS) -R .comment \ + --add-section image=$< \ + --set-section-flags image=contents,alloc,load,load,data \ + $(OBJS) $@ + +$(obj)/../Image.elf: $(obj)/Image.o $(obj)/boot.lds + $(Q)$(LD) $(KBUILD_LDFLAGS) \ + -T $(obj)/boot.lds \ + --build-id=none \ + -o $@ $(obj)/Image.o + $(Q)$(kecho) ' Kernel: $@ is ready' + +all Image: $(obj)/../Image.elf diff --git a/arch/xtensa/boot/boot-elf/boot.lds.S b/arch/xtensa/boot/boot-elf/boot.lds.S new file mode 100644 index 000000000..32a3b7c5b --- /dev/null +++ b/arch/xtensa/boot/boot-elf/boot.lds.S @@ -0,0 +1,40 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * linux/arch/xtensa/boot/boot-elf/boot.lds.S + * + * Copyright (C) 2008 - 2013 by Tensilica Inc. + * + * Chris Zankel + * Marc Gauthier + */ + +#include +OUTPUT_ARCH(xtensa) +ENTRY(_ResetVector) + +SECTIONS +{ + .ResetVector.text XCHAL_RESET_VECTOR_VADDR : + { + *(.ResetVector.text) + } + + .image KERNELOFFSET: AT (CONFIG_KERNEL_LOAD_ADDRESS) + { + _image_start = .; + *(image) + . = (. + 3) & ~ 3; + _image_end = . ; + } + + .bss ((LOADADDR(.image) + SIZEOF(.image) + 3) & ~ 3): + { + __bss_start = .; + *(.sbss) + *(.scommon) + *(.dynbss) + *(.bss) + __bss_end = .; + } +} diff --git a/arch/xtensa/boot/boot-elf/bootstrap.S b/arch/xtensa/boot/boot-elf/bootstrap.S new file mode 100644 index 000000000..2dd28931d --- /dev/null +++ b/arch/xtensa/boot/boot-elf/bootstrap.S @@ -0,0 +1,79 @@ +/* + * arch/xtensa/boot/boot-elf/bootstrap.S + * + * Low-level exception handling + * + * This file is subject to the terms and conditions of the GNU General Public + * License. See the file "COPYING" in the main directory of this archive + * for more details. + * + * Copyright (C) 2004 - 2013 by Tensilica Inc. + * + * Chris Zankel + * Marc Gauthier + * Piet Delaney + */ + +#include +#include +#include +#include + + .section .ResetVector.text, "ax" + .global _ResetVector + .global reset + +_ResetVector: + _j _SetupMMU + + .begin no-absolute-literals + .literal_position + +#ifdef CONFIG_PARSE_BOOTPARAM + .align 4 +_bootparam: + .short BP_TAG_FIRST + .short 4 + .long BP_VERSION + .short BP_TAG_LAST + .short 0 + .long 0 +#endif + + .align 4 +_SetupMMU: +#if XCHAL_HAVE_WINDOWED + movi a0, 0 + wsr a0, windowbase + rsync + movi a0, 1 + wsr a0, windowstart + rsync +#endif + movi a0, 0x1F + wsr a0, ps + rsync + +#ifndef CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX + initialize_mmu +#endif + + rsil a0, XCHAL_DEBUGLEVEL-1 + rsync +reset: +#if defined(CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX) && \ + XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY + movi a0, CONFIG_KERNEL_LOAD_ADDRESS +#else + movi a0, KERNELOFFSET +#endif +#ifdef CONFIG_PARSE_BOOTPARAM + movi a2, _bootparam +#else + movi a2, 0 +#endif + movi a3, 0 + movi a4, 0 + jx a0 + + .end no-absolute-literals -- cgit v1.3.1