From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- scripts/genksyms/keywords.c | 85 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) create mode 100644 scripts/genksyms/keywords.c (limited to 'scripts/genksyms/keywords.c') diff --git a/scripts/genksyms/keywords.c b/scripts/genksyms/keywords.c new file mode 100644 index 000000000..ee1499d27 --- /dev/null +++ b/scripts/genksyms/keywords.c @@ -0,0 +1,85 @@ +// SPDX-License-Identifier: GPL-2.0-only +static struct resword { + const char *name; + int token; +} keywords[] = { + { "__GENKSYMS_EXPORT_SYMBOL", EXPORT_SYMBOL_KEYW }, + { "__asm", ASM_KEYW }, + { "__asm__", ASM_KEYW }, + { "__attribute", ATTRIBUTE_KEYW }, + { "__attribute__", ATTRIBUTE_KEYW }, + { "__const", CONST_KEYW }, + { "__const__", CONST_KEYW }, + { "__extension__", EXTENSION_KEYW }, + { "__inline", INLINE_KEYW }, + { "__inline__", INLINE_KEYW }, + { "__signed", SIGNED_KEYW }, + { "__signed__", SIGNED_KEYW }, + { "__typeof", TYPEOF_KEYW }, + { "__typeof__", TYPEOF_KEYW }, + { "__typeof_unqual", TYPEOF_KEYW }, + { "__typeof_unqual__", TYPEOF_KEYW }, + { "__volatile", VOLATILE_KEYW }, + { "__volatile__", VOLATILE_KEYW }, + { "__builtin_va_list", VA_LIST_KEYW }, + + { "__int128", BUILTIN_INT_KEYW }, + { "__int128_t", BUILTIN_INT_KEYW }, + { "__uint128_t", BUILTIN_INT_KEYW }, + + // According to rth, c99 defines "_Bool", "__restrict", "__restrict__", "restrict". KAO + { "_Bool", BOOL_KEYW }, + { "__restrict", RESTRICT_KEYW }, + { "__restrict__", RESTRICT_KEYW }, + { "restrict", RESTRICT_KEYW }, + { "asm", ASM_KEYW }, + + // c11 keywords that can be used at module scope + { "_Static_assert", STATIC_ASSERT_KEYW }, + + // attribute commented out in modutils 2.4.2. People are using 'attribute' as a + // field name which breaks the genksyms parser. It is not a gcc keyword anyway. + // KAO. }, + // { "attribute", ATTRIBUTE_KEYW }, + + // X86 named address space qualifiers + { "__seg_gs", X86_SEG_KEYW }, + { "__seg_fs", X86_SEG_KEYW }, + + { "auto", AUTO_KEYW }, + { "char", CHAR_KEYW }, + { "const", CONST_KEYW }, + { "double", DOUBLE_KEYW }, + { "enum", ENUM_KEYW }, + { "extern", EXTERN_KEYW }, + { "float", FLOAT_KEYW }, + { "inline", INLINE_KEYW }, + { "int", INT_KEYW }, + { "long", LONG_KEYW }, + { "register", REGISTER_KEYW }, + { "short", SHORT_KEYW }, + { "signed", SIGNED_KEYW }, + { "static", STATIC_KEYW }, + { "struct", STRUCT_KEYW }, + { "typedef", TYPEDEF_KEYW }, + { "typeof", TYPEOF_KEYW }, + { "typeof_unqual", TYPEOF_KEYW }, + { "union", UNION_KEYW }, + { "unsigned", UNSIGNED_KEYW }, + { "void", VOID_KEYW }, + { "volatile", VOLATILE_KEYW }, +}; + +#define NR_KEYWORDS (sizeof(keywords)/sizeof(struct resword)) + +static int is_reserved_word(register const char *str, register unsigned int len) +{ + int i; + for (i = 0; i < NR_KEYWORDS; i++) { + struct resword *r = keywords + i; + int l = strlen(r->name); + if (len == l && !memcmp(str, r->name, len)) + return r->token; + } + return -1; +} -- cgit v1.3.1