From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/input/apm-power.c | 122 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 122 insertions(+) create mode 100644 drivers/input/apm-power.c (limited to 'drivers/input/apm-power.c') diff --git a/drivers/input/apm-power.c b/drivers/input/apm-power.c new file mode 100644 index 000000000..028fcaf4c --- /dev/null +++ b/drivers/input/apm-power.c @@ -0,0 +1,122 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Input Power Event -> APM Bridge + * + * Copyright (c) 2007 Richard Purdie + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include +#include +#include +#include +#include +#include +#include +#include + +static void system_power_event(unsigned int keycode) +{ + switch (keycode) { + case KEY_SUSPEND: + apm_queue_event(APM_USER_SUSPEND); + pr_info("Requesting system suspend...\n"); + break; + default: + break; + } +} + +static void apmpower_event(struct input_handle *handle, unsigned int type, + unsigned int code, int value) +{ + /* only react on key down events */ + if (value != 1) + return; + + switch (type) { + case EV_PWR: + system_power_event(code); + break; + + default: + break; + } +} + +static int apmpower_connect(struct input_handler *handler, + struct input_dev *dev, + const struct input_device_id *id) +{ + struct input_handle *handle; + int error; + + handle = kzalloc_obj(struct input_handle); + if (!handle) + return -ENOMEM; + + handle->dev = dev; + handle->handler = handler; + handle->name = "apm-power"; + + error = input_register_handle(handle); + if (error) { + pr_err("Failed to register input power handler, error %d\n", + error); + kfree(handle); + return error; + } + + error = input_open_device(handle); + if (error) { + pr_err("Failed to open input power device, error %d\n", error); + input_unregister_handle(handle); + kfree(handle); + return error; + } + + return 0; +} + +static void apmpower_disconnect(struct input_handle *handle) +{ + input_close_device(handle); + input_unregister_handle(handle); + kfree(handle); +} + +static const struct input_device_id apmpower_ids[] = { + { + .flags = INPUT_DEVICE_ID_MATCH_EVBIT, + .evbit = { BIT_MASK(EV_PWR) }, + }, + { }, +}; + +MODULE_DEVICE_TABLE(input, apmpower_ids); + +static struct input_handler apmpower_handler = { + .event = apmpower_event, + .connect = apmpower_connect, + .disconnect = apmpower_disconnect, + .name = "apm-power", + .id_table = apmpower_ids, +}; + +static int __init apmpower_init(void) +{ + return input_register_handler(&apmpower_handler); +} + +static void __exit apmpower_exit(void) +{ + input_unregister_handler(&apmpower_handler); +} + +module_init(apmpower_init); +module_exit(apmpower_exit); + +MODULE_AUTHOR("Richard Purdie "); +MODULE_DESCRIPTION("Input Power Event -> APM Bridge"); +MODULE_LICENSE("GPL"); -- cgit v1.3.1