From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- tools/build/tests/ex/Build | 11 ++++++ tools/build/tests/ex/Makefile | 27 +++++++++++++++ tools/build/tests/ex/a.c | 6 ++++ tools/build/tests/ex/arch/Build | 2 ++ tools/build/tests/ex/arch/e.c | 6 ++++ tools/build/tests/ex/arch/f.c | 6 ++++ tools/build/tests/ex/b.c | 6 ++++ tools/build/tests/ex/c.c | 6 ++++ tools/build/tests/ex/d.c | 6 ++++ tools/build/tests/ex/empty/Build | 0 tools/build/tests/ex/empty2/README | 2 ++ tools/build/tests/ex/ex.c | 22 ++++++++++++ tools/build/tests/ex/inc.c | 9 +++++ tools/build/tests/run.sh | 70 ++++++++++++++++++++++++++++++++++++++ 14 files changed, 179 insertions(+) create mode 100644 tools/build/tests/ex/Build create mode 100644 tools/build/tests/ex/Makefile create mode 100644 tools/build/tests/ex/a.c create mode 100644 tools/build/tests/ex/arch/Build create mode 100644 tools/build/tests/ex/arch/e.c create mode 100644 tools/build/tests/ex/arch/f.c create mode 100644 tools/build/tests/ex/b.c create mode 100644 tools/build/tests/ex/c.c create mode 100644 tools/build/tests/ex/d.c create mode 100644 tools/build/tests/ex/empty/Build create mode 100644 tools/build/tests/ex/empty2/README create mode 100644 tools/build/tests/ex/ex.c create mode 100644 tools/build/tests/ex/inc.c create mode 100755 tools/build/tests/run.sh (limited to 'tools/build/tests') diff --git a/tools/build/tests/ex/Build b/tools/build/tests/ex/Build new file mode 100644 index 000000000..4d502f9b1 --- /dev/null +++ b/tools/build/tests/ex/Build @@ -0,0 +1,11 @@ +ex-y += ex.o +ex-y += a.o +ex-y += b.o +ex-y += b.o +ex-y += empty/ +ex-y += empty2/ +ex-y += inc.o + +libex-y += c.o +libex-y += d.o +libex-y += arch/ diff --git a/tools/build/tests/ex/Makefile b/tools/build/tests/ex/Makefile new file mode 100644 index 000000000..fee032e06 --- /dev/null +++ b/tools/build/tests/ex/Makefile @@ -0,0 +1,27 @@ +# SPDX-License-Identifier: GPL-2.0 +export srctree := $(abspath ../../../..) +export CC := gcc +export LD := ld +export AR := ar + +ex: + +include $(srctree)/tools/build/Makefile.include + +ex: ex-in.o libex-in.o + $(CC) -o $@ $^ + +ex.%: fixdep FORCE + make -f $(srctree)/tools/build/Makefile.build dir=. $@ + +ex-in.o: fixdep FORCE + make $(build)=ex + +libex-in.o: fixdep FORCE + make $(build)=libex + +clean: + find . -name '*.o' -delete -o -name '\.*.cmd' -delete -o -name '\.*.d' -delete + rm -f ex ex.i ex.s + +.PHONY: FORCE diff --git a/tools/build/tests/ex/a.c b/tools/build/tests/ex/a.c new file mode 100644 index 000000000..66017a9f4 --- /dev/null +++ b/tools/build/tests/ex/a.c @@ -0,0 +1,6 @@ +// SPDX-License-Identifier: GPL-2.0 + +int a(void) +{ + return 0; +} diff --git a/tools/build/tests/ex/arch/Build b/tools/build/tests/ex/arch/Build new file mode 100644 index 000000000..55506189e --- /dev/null +++ b/tools/build/tests/ex/arch/Build @@ -0,0 +1,2 @@ +libex-y += e.o +libex-y += f.o diff --git a/tools/build/tests/ex/arch/e.c b/tools/build/tests/ex/arch/e.c new file mode 100644 index 000000000..f6ef585b5 --- /dev/null +++ b/tools/build/tests/ex/arch/e.c @@ -0,0 +1,6 @@ +// SPDX-License-Identifier: GPL-2.0 + +int e(void) +{ + return 0; +} diff --git a/tools/build/tests/ex/arch/f.c b/tools/build/tests/ex/arch/f.c new file mode 100644 index 000000000..bffd9c67e --- /dev/null +++ b/tools/build/tests/ex/arch/f.c @@ -0,0 +1,6 @@ +// SPDX-License-Identifier: GPL-2.0 + +int f(void) +{ + return 0; +} diff --git a/tools/build/tests/ex/b.c b/tools/build/tests/ex/b.c new file mode 100644 index 000000000..2b29fb4d3 --- /dev/null +++ b/tools/build/tests/ex/b.c @@ -0,0 +1,6 @@ +// SPDX-License-Identifier: GPL-2.0 + +int b(void) +{ + return 0; +} diff --git a/tools/build/tests/ex/c.c b/tools/build/tests/ex/c.c new file mode 100644 index 000000000..a63b20ab8 --- /dev/null +++ b/tools/build/tests/ex/c.c @@ -0,0 +1,6 @@ +// SPDX-License-Identifier: GPL-2.0 + +int c(void) +{ + return 0; +} diff --git a/tools/build/tests/ex/d.c b/tools/build/tests/ex/d.c new file mode 100644 index 000000000..e114e8dca --- /dev/null +++ b/tools/build/tests/ex/d.c @@ -0,0 +1,6 @@ +// SPDX-License-Identifier: GPL-2.0 + +int d(void) +{ + return 0; +} diff --git a/tools/build/tests/ex/empty/Build b/tools/build/tests/ex/empty/Build new file mode 100644 index 000000000..e69de29bb diff --git a/tools/build/tests/ex/empty2/README b/tools/build/tests/ex/empty2/README new file mode 100644 index 000000000..2107cc5bf --- /dev/null +++ b/tools/build/tests/ex/empty2/README @@ -0,0 +1,2 @@ +This directory is left intentionally without Build file +to test proper nesting into Build-less directories. diff --git a/tools/build/tests/ex/ex.c b/tools/build/tests/ex/ex.c new file mode 100644 index 000000000..3c02756ef --- /dev/null +++ b/tools/build/tests/ex/ex.c @@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0 + +int a(void); +int b(void); +int c(void); +int d(void); +int e(void); +int f(void); +int inc(void); + +int main(void) +{ + a(); + b(); + c(); + d(); + e(); + f(); + inc(); + + return 0; +} diff --git a/tools/build/tests/ex/inc.c b/tools/build/tests/ex/inc.c new file mode 100644 index 000000000..3636ab5bf --- /dev/null +++ b/tools/build/tests/ex/inc.c @@ -0,0 +1,9 @@ +// SPDX-License-Identifier: GPL-2.0 +#ifdef INCLUDE +#include "krava.h" +#endif + +int inc(void) +{ + return 0; +} diff --git a/tools/build/tests/run.sh b/tools/build/tests/run.sh new file mode 100755 index 000000000..2c54e4d43 --- /dev/null +++ b/tools/build/tests/run.sh @@ -0,0 +1,70 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0 + +function test_ex { + make -C ex V=1 clean > ex.out 2>&1 + make -C ex V=1 >> ex.out 2>&1 + + if [ ! -x ./ex/ex ]; then + echo FAILED + exit -1 + fi + + make -C ex V=1 clean > /dev/null 2>&1 + rm -f ex.out +} + +function test_ex_suffix { + make -C ex V=1 clean > ex.out 2>&1 + + # use -rR to disable make's builtin rules + make -rR -C ex V=1 ex.o >> ex.out 2>&1 + make -rR -C ex V=1 ex.i >> ex.out 2>&1 + make -rR -C ex V=1 ex.s >> ex.out 2>&1 + + if [ -x ./ex/ex ]; then + echo FAILED + exit -1 + fi + + if [ ! -f ./ex/ex.o -o ! -f ./ex/ex.i -o ! -f ./ex/ex.s ]; then + echo FAILED + exit -1 + fi + + make -C ex V=1 clean > /dev/null 2>&1 + rm -f ex.out +} + +function test_ex_include { + make -C ex V=1 clean > ex.out 2>&1 + + # build with krava.h include + touch ex/krava.h + make -C ex V=1 CFLAGS=-DINCLUDE >> ex.out 2>&1 + + if [ ! -x ./ex/ex ]; then + echo FAILED + exit -1 + fi + + # build without the include + rm -f ex/krava.h ex/ex + make -C ex V=1 >> ex.out 2>&1 + + if [ ! -x ./ex/ex ]; then + echo FAILED + exit -1 + fi + + make -C ex V=1 clean > /dev/null 2>&1 + rm -f ex.out +} + +echo -n Testing.. + +test_ex +test_ex_suffix +test_ex_include + +echo OK -- cgit v1.3.1