From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/Kconfig | 162 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 162 insertions(+) create mode 100644 drivers/usb/Kconfig (limited to 'drivers/usb/Kconfig') diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig new file mode 100644 index 000000000..abf8c6cde --- /dev/null +++ b/drivers/usb/Kconfig @@ -0,0 +1,162 @@ +# SPDX-License-Identifier: GPL-2.0 +# +# USB device configuration +# + +config USB_OHCI_BIG_ENDIAN_DESC + bool + +config USB_OHCI_BIG_ENDIAN_MMIO + bool + +config USB_OHCI_LITTLE_ENDIAN + bool + default n if PPC_MPC52xx + default y + +config USB_EHCI_BIG_ENDIAN_MMIO + bool + +config USB_EHCI_BIG_ENDIAN_DESC + bool + +config USB_UHCI_BIG_ENDIAN_MMIO + bool + +config USB_UHCI_BIG_ENDIAN_DESC + bool + +menuconfig USB_SUPPORT + bool "USB support" + depends on HAS_IOMEM + default y + help + This option adds core support for Universal Serial Bus (USB). + You will also need drivers from the following menu to make use of it. + +if USB_SUPPORT + +source "drivers/usb/common/Kconfig" + +config USB_ARCH_HAS_HCD + def_bool y + +config USB + tristate "Support for Host-side USB" + depends on USB_ARCH_HAS_HCD + select GENERIC_ALLOCATOR + select USB_COMMON + select NLS # for UTF-8 strings + help + Universal Serial Bus (USB) is a specification for a serial bus + subsystem which offers higher speeds and more features than the + traditional PC serial port. The bus supplies power to peripherals + and allows for hot swapping. Up to 127 USB peripherals can be + connected to a single USB host in a tree structure. + + The USB host is the root of the tree, the peripherals are the + leaves and the inner nodes are special USB devices called hubs. + Most PCs now have USB host ports, used to connect peripherals + such as scanners, keyboards, mice, modems, cameras, disks, + flash memory, network links, and printers to the PC. + + Say Y here if your computer has a host-side USB port and you want + to use USB devices. You then need to say Y to at least one of the + Host Controller Driver (HCD) options below. Choose a USB 1.1 + controller, such as "UHCI HCD support" or "OHCI HCD support", + and "EHCI HCD (USB 2.0) support" except for older systems that + do not have USB 2.0 support. It doesn't normally hurt to select + them all if you are not certain. + + If your system has a device-side USB port, used in the peripheral + side of the USB protocol, see the "USB Gadget" framework instead. + + After choosing your HCD, then select drivers for the USB peripherals + you'll be using. You may want to check out the information provided + in and especially the links given in + . + + To compile this driver as a module, choose M here: the + module will be called usbcore. + +config USB_PCI + bool "PCI based USB host interface" + depends on PCI + default y + help + Many embedded system SOCs (e.g. freescale T2080) have both + PCI and USB modules with the USB module directly controlled by + registers and having no relationship to the PCI module. + + If you have such a device you may say N here and PCI related code + will not be built in the USB driver. + +config USB_PCI_AMD + bool "AMD PCI USB host support" + depends on USB_PCI && HAS_IOPORT + default X86 || MACH_LOONGSON64 || PPC_PASEMI + help + Enable workarounds for USB implementation quirks in SB600/SB700/SB800 + and later south bridge implementations. These are common on x86 PCs + with AMD CPUs but rarely used elsewhere, with the exception of a few + powerpc and mips desktop machines. + +if USB + +source "drivers/usb/core/Kconfig" + +source "drivers/usb/mon/Kconfig" + +source "drivers/usb/host/Kconfig" + +source "drivers/usb/renesas_usbhs/Kconfig" + +source "drivers/usb/class/Kconfig" + +source "drivers/usb/storage/Kconfig" + +source "drivers/usb/image/Kconfig" + +source "drivers/usb/usbip/Kconfig" + +endif + +comment "USB dual-mode controller drivers" + +source "drivers/usb/cdns3/Kconfig" + +source "drivers/usb/fotg210/Kconfig" + +source "drivers/usb/mtu3/Kconfig" + +source "drivers/usb/musb/Kconfig" + +source "drivers/usb/dwc3/Kconfig" + +source "drivers/usb/dwc2/Kconfig" + +source "drivers/usb/chipidea/Kconfig" + +source "drivers/usb/isp1760/Kconfig" + +comment "USB port drivers" + +if USB + +source "drivers/usb/serial/Kconfig" + +source "drivers/usb/misc/Kconfig" + +source "drivers/usb/atm/Kconfig" + +endif # USB + +source "drivers/usb/phy/Kconfig" + +source "drivers/usb/gadget/Kconfig" + +source "drivers/usb/typec/Kconfig" + +source "drivers/usb/roles/Kconfig" + +endif # USB_SUPPORT -- cgit v1.3.1