From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- include/sound/i2c.h | 88 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 include/sound/i2c.h (limited to 'include/sound/i2c.h') diff --git a/include/sound/i2c.h b/include/sound/i2c.h new file mode 100644 index 000000000..6f0162ae9 --- /dev/null +++ b/include/sound/i2c.h @@ -0,0 +1,88 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +#ifndef __SOUND_I2C_H +#define __SOUND_I2C_H + +/* + */ + +#define SND_I2C_DEVICE_ADDRTEN (1<<0) /* 10-bit I2C address */ + +struct snd_i2c_device { + struct list_head list; + struct snd_i2c_bus *bus; /* I2C bus */ + char name[32]; /* some useful device name */ + unsigned short flags; /* device flags */ + unsigned short addr; /* device address (might be 10-bit) */ + unsigned long private_value; + void *private_data; + void (*private_free)(struct snd_i2c_device *device); +}; + +#define snd_i2c_device(n) list_entry(n, struct snd_i2c_device, list) + +struct snd_i2c_bit_ops { + void (*start)(struct snd_i2c_bus *bus); /* transfer start */ + void (*stop)(struct snd_i2c_bus *bus); /* transfer stop */ + void (*direction)(struct snd_i2c_bus *bus, int clock, int data); /* set line direction (0 = write, 1 = read) */ + void (*setlines)(struct snd_i2c_bus *bus, int clock, int data); + int (*getclock)(struct snd_i2c_bus *bus); + int (*getdata)(struct snd_i2c_bus *bus, int ack); +}; + +struct snd_i2c_ops { + int (*sendbytes)(struct snd_i2c_device *device, unsigned char *bytes, int count); + int (*readbytes)(struct snd_i2c_device *device, unsigned char *bytes, int count); + int (*probeaddr)(struct snd_i2c_bus *bus, unsigned short addr); +}; + +struct snd_i2c_bus { + struct snd_card *card; /* card which I2C belongs to */ + char name[32]; /* some useful label */ + + struct mutex lock_mutex; + + struct snd_i2c_bus *master; /* master bus when SCK/SCL is shared */ + struct list_head buses; /* master: slave buses sharing SCK/SCL, slave: link list */ + + struct list_head devices; /* attached devices to this bus */ + + union { + struct snd_i2c_bit_ops *bit; + void *ops; + } hw_ops; /* lowlevel operations */ + const struct snd_i2c_ops *ops; /* midlevel operations */ + + unsigned long private_value; + void *private_data; + void (*private_free)(struct snd_i2c_bus *bus); +}; + +#define snd_i2c_slave_bus(n) list_entry(n, struct snd_i2c_bus, buses) + +int snd_i2c_bus_create(struct snd_card *card, const char *name, + struct snd_i2c_bus *master, struct snd_i2c_bus **ri2c); +int snd_i2c_device_create(struct snd_i2c_bus *bus, const char *name, + unsigned char addr, struct snd_i2c_device **rdevice); +int snd_i2c_device_free(struct snd_i2c_device *device); + +static inline void snd_i2c_lock(struct snd_i2c_bus *bus) +{ + if (bus->master) + mutex_lock(&bus->master->lock_mutex); + else + mutex_lock(&bus->lock_mutex); +} + +static inline void snd_i2c_unlock(struct snd_i2c_bus *bus) +{ + if (bus->master) + mutex_unlock(&bus->master->lock_mutex); + else + mutex_unlock(&bus->lock_mutex); +} + +int snd_i2c_sendbytes(struct snd_i2c_device *device, unsigned char *bytes, int count); +int snd_i2c_readbytes(struct snd_i2c_device *device, unsigned char *bytes, int count); +int snd_i2c_probeaddr(struct snd_i2c_bus *bus, unsigned short addr); + +#endif /* __SOUND_I2C_H */ -- cgit v1.3.1