From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- fs/sysfs/dir.c | 161 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 161 insertions(+) create mode 100644 fs/sysfs/dir.c (limited to 'fs/sysfs/dir.c') diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c new file mode 100644 index 000000000..ffdcd4153 --- /dev/null +++ b/fs/sysfs/dir.c @@ -0,0 +1,161 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * fs/sysfs/dir.c - sysfs core and dir operation implementation + * + * Copyright (c) 2001-3 Patrick Mochel + * Copyright (c) 2007 SUSE Linux Products GmbH + * Copyright (c) 2007 Tejun Heo + * + * Please see Documentation/filesystems/sysfs.rst for more information. + */ + +#define pr_fmt(fmt) "sysfs: " fmt + +#include +#include +#include +#include "sysfs.h" + +DEFINE_SPINLOCK(sysfs_symlink_target_lock); + +void sysfs_warn_dup(struct kernfs_node *parent, const char *name) +{ + char *buf; + + buf = kzalloc(PATH_MAX, GFP_KERNEL); + if (buf) + kernfs_path(parent, buf, PATH_MAX); + + pr_warn("cannot create duplicate filename '%s/%s'\n", buf, name); + dump_stack(); + + kfree(buf); +} + +/** + * sysfs_create_dir_ns - create a directory for an object with a namespace tag + * @kobj: object we're creating directory for + * @ns: the namespace tag to use + */ +int sysfs_create_dir_ns(struct kobject *kobj, const struct ns_common *ns) +{ + struct kernfs_node *parent, *kn; + kuid_t uid; + kgid_t gid; + + if (WARN_ON(!kobj)) + return -EINVAL; + + if (kobj->parent) + parent = kobj->parent->sd; + else + parent = sysfs_root_kn; + + if (!parent) + return -ENOENT; + + kobject_get_ownership(kobj, &uid, &gid); + + kn = kernfs_create_dir_ns(parent, kobject_name(kobj), 0755, uid, gid, + kobj, ns); + if (IS_ERR(kn)) { + if (PTR_ERR(kn) == -EEXIST) + sysfs_warn_dup(parent, kobject_name(kobj)); + return PTR_ERR(kn); + } + + kobj->sd = kn; + return 0; +} + +/** + * sysfs_remove_dir - remove an object's directory. + * @kobj: object. + * + * The only thing special about this is that we remove any files in + * the directory before we remove the directory, and we've inlined + * what used to be sysfs_rmdir() below, instead of calling separately. + */ +void sysfs_remove_dir(struct kobject *kobj) +{ + struct kernfs_node *kn = kobj->sd; + + /* + * In general, kobject owner is responsible for ensuring removal + * doesn't race with other operations and sysfs doesn't provide any + * protection; however, when @kobj is used as a symlink target, the + * symlinking entity usually doesn't own @kobj and thus has no + * control over removal. @kobj->sd may be removed anytime + * and symlink code may end up dereferencing an already freed node. + * + * sysfs_symlink_target_lock synchronizes @kobj->sd + * disassociation against symlink operations so that symlink code + * can safely dereference @kobj->sd. + */ + spin_lock(&sysfs_symlink_target_lock); + kobj->sd = NULL; + spin_unlock(&sysfs_symlink_target_lock); + + if (kn) { + WARN_ON_ONCE(kernfs_type(kn) != KERNFS_DIR); + kernfs_remove(kn); + } +} + +int sysfs_rename_dir_ns(struct kobject *kobj, const char *new_name, + const struct ns_common *new_ns) +{ + struct kernfs_node *parent; + int ret; + + parent = kernfs_get_parent(kobj->sd); + ret = kernfs_rename_ns(kobj->sd, parent, new_name, new_ns); + kernfs_put(parent); + return ret; +} + +int sysfs_move_dir_ns(struct kobject *kobj, struct kobject *new_parent_kobj, + const struct ns_common *new_ns) +{ + struct kernfs_node *kn = kobj->sd; + struct kernfs_node *new_parent; + + new_parent = new_parent_kobj && new_parent_kobj->sd ? + new_parent_kobj->sd : sysfs_root_kn; + + return kernfs_rename_ns(kn, new_parent, NULL, new_ns); +} + +/** + * sysfs_create_mount_point - create an always empty directory + * @parent_kobj: kobject that will contain this always empty directory + * @name: The name of the always empty directory to add + */ +int sysfs_create_mount_point(struct kobject *parent_kobj, const char *name) +{ + struct kernfs_node *kn, *parent = parent_kobj->sd; + + kn = kernfs_create_empty_dir(parent, name); + if (IS_ERR(kn)) { + if (PTR_ERR(kn) == -EEXIST) + sysfs_warn_dup(parent, name); + return PTR_ERR(kn); + } + + return 0; +} +EXPORT_SYMBOL_GPL(sysfs_create_mount_point); + +/** + * sysfs_remove_mount_point - remove an always empty directory. + * @parent_kobj: kobject that will contain this always empty directory + * @name: The name of the always empty directory to remove + * + */ +void sysfs_remove_mount_point(struct kobject *parent_kobj, const char *name) +{ + struct kernfs_node *parent = parent_kobj->sd; + + kernfs_remove_by_name_ns(parent, name, NULL); +} +EXPORT_SYMBOL_GPL(sysfs_remove_mount_point); -- cgit v1.3.1