From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/input/Kconfig | 204 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 204 insertions(+) create mode 100644 drivers/input/Kconfig (limited to 'drivers/input/Kconfig') diff --git a/drivers/input/Kconfig b/drivers/input/Kconfig new file mode 100644 index 000000000..88ecdf521 --- /dev/null +++ b/drivers/input/Kconfig @@ -0,0 +1,204 @@ +# SPDX-License-Identifier: GPL-2.0-only +# +# Input device configuration +# + +menu "Input device support" + +config INPUT + tristate "Generic input layer (needed for keyboard, mouse, ...)" if EXPERT + default y + help + Say Y here if you have any input device (mouse, keyboard, tablet, + joystick, steering wheel ...) connected to your system and want + it to be available to applications. This includes standard PS/2 + keyboard and mouse. + + Say N here if you have a headless (no monitor, no keyboard) system. + + More information is available: + + If unsure, say Y. + + To compile this driver as a module, choose M here: the + module will be called input. + +if INPUT + +config INPUT_LEDS + tristate "Export input device LEDs in sysfs" + depends on LEDS_CLASS + default INPUT + help + Say Y here if you would like to export LEDs on input devices + as standard LED class devices in sysfs. + + If unsure, say Y. + + To compile this driver as a module, choose M here: the + module will be called input-leds. + +config INPUT_FF_MEMLESS + tristate "Support for memoryless force-feedback devices" + help + Say Y here if you have memoryless force-feedback input device + such as Logitech WingMan Force 3D, ThrustMaster FireStorm Dual + Power 2, or similar. You will also need to enable hardware-specific + driver. + + If unsure, say N. + + To compile this driver as a module, choose M here: the + module will be called ff-memless. + +config INPUT_SPARSEKMAP + tristate "Sparse keymap support library" + help + Say Y here if you are using a driver for an input + device that uses sparse keymap. This option is only + useful for out-of-tree drivers since in-tree drivers + select it automatically. + + If unsure, say N. + + To compile this driver as a module, choose M here: the + module will be called sparse-keymap. + +config INPUT_MATRIXKMAP + tristate "Matrix keymap support library" + help + Say Y here if you are using a driver for an input + device that uses matrix keymap. This option is only + useful for out-of-tree drivers since in-tree drivers + select it automatically. + + If unsure, say N. + + To compile this driver as a module, choose M here: the + module will be called matrix-keymap. + +config INPUT_VIVALDIFMAP + tristate + help + ChromeOS Vivaldi keymap support library. This is a hidden + option so that drivers can use common code to parse and + expose the vivaldi function row keymap. + +comment "Userland interfaces" + +config INPUT_MOUSEDEV + tristate "Mouse interface" + help + Say Y here if you want your mouse to be accessible as char devices + 13:32+ - /dev/input/mouseX and 13:63 - /dev/input/mice as an + emulated IntelliMouse Explorer PS/2 mouse. That way, all user space + programs (including SVGAlib, GPM and X) will be able to use your + mouse. + + If unsure, say Y. + + To compile this driver as a module, choose M here: the + module will be called mousedev. + +config INPUT_MOUSEDEV_PSAUX + bool "Provide legacy /dev/psaux device" + depends on INPUT_MOUSEDEV + help + Say Y here if you want your mouse also be accessible as char device + 10:1 - /dev/psaux. The data available through /dev/psaux is exactly + the same as the data from /dev/input/mice. + + If unsure, say Y. + +config INPUT_MOUSEDEV_SCREEN_X + int "Horizontal screen resolution" + depends on INPUT_MOUSEDEV + default "1024" + help + If you're using a digitizer, or a graphic tablet, and want to use + it as a mouse then the mousedev driver needs to know the X window + screen resolution you are using to correctly scale the data. If + you're not using a digitizer, this value is ignored. + +config INPUT_MOUSEDEV_SCREEN_Y + int "Vertical screen resolution" + depends on INPUT_MOUSEDEV + default "768" + help + If you're using a digitizer, or a graphic tablet, and want to use + it as a mouse then the mousedev driver needs to know the X window + screen resolution you are using to correctly scale the data. If + you're not using a digitizer, this value is ignored. + +config INPUT_JOYDEV + tristate "Joystick interface" + help + Say Y here if you want your joystick or gamepad to be + accessible as char device 13:0+ - /dev/input/jsX device. + + If unsure, say Y. + + More information is available: + + To compile this driver as a module, choose M here: the + module will be called joydev. + +config INPUT_EVDEV + tristate "Event interface" + help + Say Y here if you want your input device events be accessible + under char device 13:64+ - /dev/input/eventX in a generic way. + + To compile this driver as a module, choose M here: the + module will be called evdev. + +config INPUT_KUNIT_TEST + tristate "KUnit tests for Input" if !KUNIT_ALL_TESTS + depends on INPUT && KUNIT + default KUNIT_ALL_TESTS + help + Say Y here if you want to build the KUnit tests for the input + subsystem. + + If in doubt, say "N". + +config INPUT_APMPOWER + tristate "Input Power Event -> APM Bridge" if EXPERT + depends on INPUT && APM_EMULATION + help + Say Y here if you want suspend key events to trigger a user + requested suspend through APM. This is useful on embedded + systems where such behaviour is desired without userspace + interaction. If unsure, say N. + + To compile this driver as a module, choose M here: the + module will be called apm-power. + +comment "Input Device Drivers" + +source "drivers/input/keyboard/Kconfig" + +source "drivers/input/mouse/Kconfig" + +source "drivers/input/joystick/Kconfig" + +source "drivers/input/tablet/Kconfig" + +source "drivers/input/touchscreen/Kconfig" + +source "drivers/input/misc/Kconfig" + +source "drivers/input/rmi4/Kconfig" + +endif + +menu "Hardware I/O ports" + +source "drivers/input/serio/Kconfig" + +source "drivers/input/gameport/Kconfig" + +endmenu + +endmenu + -- cgit v1.3.1