From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- lib/crc/Kconfig | 130 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 130 insertions(+) create mode 100644 lib/crc/Kconfig (limited to 'lib/crc/Kconfig') diff --git a/lib/crc/Kconfig b/lib/crc/Kconfig new file mode 100644 index 000000000..927fc6a6b --- /dev/null +++ b/lib/crc/Kconfig @@ -0,0 +1,130 @@ +# SPDX-License-Identifier: GPL-2.0-only + +# Kconfig for the kernel's cyclic redundancy check (CRC) library code + +config CRC4 + tristate + help + The CRC4 library functions. Select this if your module uses any of + the functions from . + +config CRC7 + tristate + help + The CRC7 library functions. Select this if your module uses any of + the functions from . + +config CRC8 + tristate + help + The CRC8 library functions. Select this if your module uses any of + the functions from . + +config CRC16 + tristate + help + The CRC16 library functions. Select this if your module uses any of + the functions from . + +config CRC_CCITT + tristate + help + The CRC-CCITT library functions. Select this if your module uses any + of the functions from . + +config CRC_ITU_T + tristate + help + The CRC-ITU-T library functions. Select this if your module uses + any of the functions from . + +config CRC_T10DIF + tristate + help + The CRC-T10DIF library functions. Select this if your module uses + any of the functions from . + +config CRC_T10DIF_ARCH + bool + depends on CRC_T10DIF && CRC_OPTIMIZATIONS + default y if ARM && KERNEL_MODE_NEON + default y if ARM64 + default y if PPC64 && ALTIVEC + default y if RISCV && RISCV_ISA_ZBC + default y if X86 + +config CRC32 + tristate + select BITREVERSE + help + The CRC32 library functions. Select this if your module uses any of + the functions from or . + +config CRC32_ARCH + bool + depends on CRC32 && CRC_OPTIMIZATIONS + default y if ARM && KERNEL_MODE_NEON + default y if ARM64 + default y if LOONGARCH && 64BIT + default y if MIPS && CPU_MIPSR6 + default y if PPC64 && ALTIVEC + default y if RISCV && RISCV_ISA_ZBC + default y if S390 + default y if SPARC64 + default y if X86 + +config CRC64 + tristate + help + The CRC64 library functions. Select this if your module uses any of + the functions from . + +config CRC64_ARCH + bool + depends on CRC64 && CRC_OPTIMIZATIONS + default y if ARM && KERNEL_MODE_NEON && !CPU_BIG_ENDIAN + default y if ARM64 + default y if RISCV && RISCV_ISA_ZBC && 64BIT + default y if X86_64 + +config CRC_OPTIMIZATIONS + bool "Enable optimized CRC implementations" if EXPERT + depends on !UML + default y + help + Disabling this option reduces code size slightly by disabling the + architecture-optimized implementations of any CRC variants that are + enabled. CRC checksumming performance may get much slower. + + Keep this enabled unless you're really trying to minimize the size of + the kernel. + +config CRC_KUNIT_TEST + tristate "KUnit tests for CRC functions" if !KUNIT_ALL_TESTS + depends on KUNIT && (CRC7 || CRC16 || CRC_T10DIF || CRC32 || CRC64) + default KUNIT_ALL_TESTS + help + Unit tests for the CRC library functions. + + This is intended to help people writing architecture-specific + optimized versions. If unsure, say N. + +config CRC_ENABLE_ALL_FOR_KUNIT + tristate "Enable all CRC functions for KUnit test" + depends on KUNIT + select CRC7 + select CRC16 + select CRC_T10DIF + select CRC32 + select CRC64 + help + Enable all CRC functions that have test code in CRC_KUNIT_TEST. + + Enable this only if you'd like the CRC KUnit test suite to test all + the CRC variants, even ones that wouldn't otherwise need to be built. + +config CRC_BENCHMARK + bool "Benchmark for the CRC functions" + depends on CRC_KUNIT_TEST + help + Include benchmarks in the KUnit test suite for the CRC functions. -- cgit v1.3.1