From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- tools/perf/util/data.h | 144 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 144 insertions(+) create mode 100644 tools/perf/util/data.h (limited to 'tools/perf/util/data.h') diff --git a/tools/perf/util/data.h b/tools/perf/util/data.h new file mode 100644 index 000000000..76f57f603 --- /dev/null +++ b/tools/perf/util/data.h @@ -0,0 +1,144 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __PERF_DATA_H +#define __PERF_DATA_H + +#include +#include +#include +#include + +enum perf_data_mode { + PERF_DATA_MODE_WRITE, + PERF_DATA_MODE_READ, +}; + +enum perf_dir_version { + PERF_DIR_SINGLE_FILE = 0, + PERF_DIR_VERSION = 1, +}; + +/** + * struct perf_data_file: A wrapper around a file used for perf.data reading or writing. Generally + * part of struct perf_data. + */ +struct perf_data_file { + /** + * @path: Path of file. Generally a copy of perf_data.path but for a + * directory it is the file within the directory. + */ + char *path; + union { + /** @fd: File descriptor for read/writes. Valid if use_stdio is false. */ + int fd; + /** + * @fptr: Stdio FILE. Valid if use_stdio is true, currently just + * pipes in perf inject. + */ + FILE *fptr; + }; + /** @size: Size of file when opened. */ + unsigned long size; + /** @use_stdio: Use buffered stdio operations. */ + bool use_stdio; +}; + +/** + * struct perf_data: A wrapper around a file used for perf.data reading or writing. + */ +struct perf_data { + /** @path: Path to open and of the file. NULL implies 'perf.data' will be used. */ + const char *path; + /** @file: Underlying file to be used. */ + struct perf_data_file file; + /** @open: Has the file or directory been opened. */ + bool open; + /** @is_pipe: Underlying file is a pipe. */ + bool is_pipe; + /** @is_dir: Underlying file is a directory. */ + bool is_dir; + /** @force: Ignore opening a file creating created by a different user. */ + bool force; + /** @in_place_update: A file opened for reading but will be written to. */ + bool in_place_update; + /** @mode: Read or write mode. */ + enum perf_data_mode mode:8; + + struct { + /** @version: perf_dir_version. */ + u64 version; + /** @files: perf data files for the directory. */ + struct perf_data_file *files; + /** @nr: Number of perf data files for the directory. */ + int nr; + } dir; +}; + +static inline int perf_data_file__fd(struct perf_data_file *file) +{ + return file->use_stdio ? fileno(file->fptr) : file->fd; +} + +ssize_t perf_data_file__write(struct perf_data_file *file, + void *buf, size_t size); +off_t perf_data_file__seek(struct perf_data_file *file, off_t offset, int whence); + + +static inline bool perf_data__is_read(struct perf_data *data) +{ + return data->mode == PERF_DATA_MODE_READ; +} + +static inline bool perf_data__is_write(struct perf_data *data) +{ + return data->mode == PERF_DATA_MODE_WRITE; +} + +static inline int perf_data__is_pipe(struct perf_data *data) +{ + return data->is_pipe; +} + +static inline bool perf_data__is_dir(struct perf_data *data) +{ + return data->is_dir; +} + +static inline bool perf_data__is_single_file(struct perf_data *data) +{ + return data->dir.version == PERF_DIR_SINGLE_FILE; +} + +static inline int perf_data__fd(struct perf_data *data) +{ + return perf_data_file__fd(&data->file); +} + +int perf_data__open(struct perf_data *data); +void perf_data__close(struct perf_data *data); +ssize_t perf_data__read(struct perf_data *data, void *buf, size_t size); +ssize_t perf_data__write(struct perf_data *data, + void *buf, size_t size); +off_t perf_data__seek(struct perf_data *data, off_t offset, int whence); +/* + * If at_exit is set, only rename current perf.data to + * perf.data., continue write on original data. + * Set at_exit when flushing the last output. + * + * Return value is fd of new output. + */ +int perf_data__switch(struct perf_data *data, + const char *postfix, + size_t pos, bool at_exit, char **new_filepath); + +int perf_data__create_dir(struct perf_data *data, int nr); +int perf_data__open_dir(struct perf_data *data); +void perf_data__close_dir(struct perf_data *data); +unsigned long perf_data__size(struct perf_data *data); +int perf_data__make_kcore_dir(struct perf_data *data, char *buf, size_t buf_sz); +char *perf_data__kallsyms_name(struct perf_data *data); +char *perf_data__guest_kallsyms_name(struct perf_data *data, pid_t machine_pid); + +bool has_kcore_dir(const char *path); +bool is_perf_data(const char *path); + +#endif /* __PERF_DATA_H */ -- cgit v1.3.1