From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- arch/xtensa/boot/lib/.gitignore | 4 ++ arch/xtensa/boot/lib/Makefile | 34 +++++++++++++++++ arch/xtensa/boot/lib/zmem.c | 81 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 119 insertions(+) create mode 100644 arch/xtensa/boot/lib/.gitignore create mode 100644 arch/xtensa/boot/lib/Makefile create mode 100644 arch/xtensa/boot/lib/zmem.c (limited to 'arch/xtensa/boot/lib') diff --git a/arch/xtensa/boot/lib/.gitignore b/arch/xtensa/boot/lib/.gitignore new file mode 100644 index 000000000..805a82492 --- /dev/null +++ b/arch/xtensa/boot/lib/.gitignore @@ -0,0 +1,4 @@ +# SPDX-License-Identifier: GPL-2.0-only +inffast.c +inflate.c +inftrees.c diff --git a/arch/xtensa/boot/lib/Makefile b/arch/xtensa/boot/lib/Makefile new file mode 100644 index 000000000..0378a22a0 --- /dev/null +++ b/arch/xtensa/boot/lib/Makefile @@ -0,0 +1,34 @@ +# SPDX-License-Identifier: GPL-2.0 +# +# Makefile for some libs needed by zImage. +# + +zlib := inffast.c inflate.c inftrees.c + +lib-y += $(zlib:.c=.o) zmem.o + +ccflags-y := -I $(srctree)/lib/zlib_inflate +ifdef CONFIG_FUNCTION_TRACER +CFLAGS_REMOVE_inflate.o = -pg +CFLAGS_REMOVE_zmem.o = -pg +CFLAGS_REMOVE_inftrees.o = -pg +CFLAGS_REMOVE_inffast.o = -pg +endif + +KASAN_SANITIZE := n +KCSAN_SANITIZE := n +KCOV_INSTRUMENT := n +GCOV_PROFILE := n + +CFLAGS_REMOVE_inflate.o += -fstack-protector -fstack-protector-strong +CFLAGS_REMOVE_zmem.o += -fstack-protector -fstack-protector-strong +CFLAGS_REMOVE_inftrees.o += -fstack-protector -fstack-protector-strong +CFLAGS_REMOVE_inffast.o += -fstack-protector -fstack-protector-strong + +quiet_cmd_copy_zlib = COPY $@ + cmd_copy_zlib = cat $< > $@ + +$(addprefix $(obj)/,$(zlib)): $(obj)/%: $(srctree)/lib/zlib_inflate/% + $(call cmd,copy_zlib) + +clean-files := $(zlib) diff --git a/arch/xtensa/boot/lib/zmem.c b/arch/xtensa/boot/lib/zmem.c new file mode 100644 index 000000000..b89189355 --- /dev/null +++ b/arch/xtensa/boot/lib/zmem.c @@ -0,0 +1,81 @@ +// SPDX-License-Identifier: GPL-2.0 +#include + +/* bits taken from ppc */ + +extern void *avail_ram, *end_avail; +void gunzip(void *dst, int dstlen, unsigned char *src, int *lenp); + +static void exit(void) +{ + for (;;); +} + +static void *zalloc(unsigned int size) +{ + void *p = avail_ram; + + size = (size + 7) & -8; + avail_ram += size; + if (avail_ram > end_avail) { + //puts("oops... out of memory\n"); + //pause(); + exit (); + } + return p; +} + +#define HEAD_CRC 2 +#define EXTRA_FIELD 4 +#define ORIG_NAME 8 +#define COMMENT 0x10 +#define RESERVED 0xe0 + +#define DEFLATED 8 + +void gunzip (void *dst, int dstlen, unsigned char *src, int *lenp) +{ + z_stream s; + int r, i, flags; + + /* skip header */ + i = 10; + flags = src[3]; + if (src[2] != DEFLATED || (flags & RESERVED) != 0) { + //puts("bad gzipped data\n"); + exit(); + } + if ((flags & EXTRA_FIELD) != 0) + i = 12 + src[10] + (src[11] << 8); + if ((flags & ORIG_NAME) != 0) + while (src[i++] != 0) + ; + if ((flags & COMMENT) != 0) + while (src[i++] != 0) + ; + if ((flags & HEAD_CRC) != 0) + i += 2; + if (i >= *lenp) { + //puts("gunzip: ran out of data in header\n"); + exit(); + } + + s.workspace = zalloc(zlib_inflate_workspacesize()); + r = zlib_inflateInit2(&s, -MAX_WBITS); + if (r != Z_OK) { + //puts("inflateInit2 returned "); puthex(r); puts("\n"); + exit(); + } + s.next_in = src + i; + s.avail_in = *lenp - i; + s.next_out = dst; + s.avail_out = dstlen; + r = zlib_inflate(&s, Z_FINISH); + if (r != Z_OK && r != Z_STREAM_END) { + //puts("inflate returned "); puthex(r); puts("\n"); + exit(); + } + *lenp = s.next_out - (unsigned char *) dst; + zlib_inflateEnd(&s); +} + -- cgit v1.3.1