From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/video/Kconfig | 95 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 drivers/video/Kconfig (limited to 'drivers/video/Kconfig') diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig new file mode 100644 index 000000000..a7144d275 --- /dev/null +++ b/drivers/video/Kconfig @@ -0,0 +1,95 @@ +# SPDX-License-Identifier: GPL-2.0-only +# +# Video configuration +# + +menu "Graphics support" + +config APERTURE_HELPERS + bool + help + Support tracking and hand-over of aperture ownership. Required + by graphics drivers for firmware-provided framebuffers. + +config SCREEN_INFO + bool + default n + +config STI_CORE + bool + depends on PARISC + help + STI refers to the HP "Standard Text Interface" which is a set of + BIOS routines contained in a ROM chip in HP PA-RISC based machines. + +config VIDEO + bool + default n + +source "drivers/auxdisplay/Kconfig" + +if HAS_IOMEM + +config HAVE_FB_ATMEL + bool + +source "drivers/char/agp/Kconfig" + +source "drivers/gpu/vga/Kconfig" + +source "drivers/gpu/Kconfig" +source "drivers/gpu/host1x/Kconfig" +source "drivers/gpu/ipu-v3/Kconfig" +source "drivers/gpu/nova-core/Kconfig" + +source "drivers/gpu/drm/Kconfig" + +menu "Frame buffer Devices" +source "drivers/video/fbdev/Kconfig" +endmenu + +source "drivers/video/backlight/Kconfig" + +config VGASTATE + tristate + default n + +config VIDEOMODE_HELPERS + bool + +config HDMI + bool + +endif # HAS_IOMEM + +config FIRMWARE_EDID + bool "Enable firmware EDID" + depends on EFI_GENERIC_STUB || X86 + help + This enables access to the EDID transferred from the firmware. + On EFI systems, the EDID comes from the same device as the + primary GOP. On x86 with BIOS, it comes from the VESA BIOS. + DRM display drivers will be able to export the information + to userspace. + + Also enable this if DDC/I2C transfers do not work for your driver + and if you are using nvidiafb, i810fb or savagefb. + + In general, choosing Y for this option is safe. If you + experience extremely long delays while booting before you get + something on your display, try setting this to N. Matrox cards in + combination with certain motherboards and monitors are known to + suffer from this problem. + +if VT + source "drivers/video/console/Kconfig" +endif + +if FB_CORE || SGI_NEWPORT_CONSOLE + source "drivers/video/logo/Kconfig" + +endif + +source "drivers/gpu/trace/Kconfig" + +endmenu -- cgit v1.3.1