From ff917923f4fb9c83717ba135ee47d7e4c1567bb7 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Tue, 28 Jul 2026 17:54:55 +0500 Subject: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman --- tools/perf/util/maps.h | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 tools/perf/util/maps.h (limited to 'tools/perf/util/maps.h') diff --git a/tools/perf/util/maps.h b/tools/perf/util/maps.h new file mode 100644 index 000000000..4ec9b7453 --- /dev/null +++ b/tools/perf/util/maps.h @@ -0,0 +1,88 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __PERF_MAPS_H +#define __PERF_MAPS_H + +#include +#include +#include +#include + +struct ref_reloc_sym; +struct machine; +struct map; +struct maps; + +#define KMAP_NAME_LEN 256 + +struct kmap { + struct ref_reloc_sym *ref_reloc_sym; + struct maps *kmaps; + char name[KMAP_NAME_LEN]; +}; + +struct maps *maps__new(struct machine *machine); +bool maps__empty(struct maps *maps); +int maps__copy_from(struct maps *maps, struct maps *parent); + +struct maps *maps__get(struct maps *maps); +void maps__put(struct maps *maps); + +static inline void __maps__zput(struct maps **map) +{ + maps__put(*map); + *map = NULL; +} + +#define maps__zput(map) __maps__zput(&map) + +bool maps__equal(struct maps *a, struct maps *b); + +/* Iterate over map calling cb for each entry. */ +int maps__for_each_map(struct maps *maps, int (*cb)(struct map *map, void *data), void *data); +/* Iterate over map removing an entry if cb returns true. */ +void maps__remove_maps(struct maps *maps, bool (*cb)(struct map *map, void *data), void *data); + +struct machine *maps__machine(const struct maps *maps); +unsigned int maps__nr_maps(const struct maps *maps); /* Test only. */ +refcount_t *maps__refcnt(struct maps *maps); /* Test only. */ + +#ifdef HAVE_LIBUNWIND_SUPPORT +void *maps__addr_space(const struct maps *maps); +void maps__set_addr_space(struct maps *maps, void *addr_space); +uint16_t maps__e_machine(const struct maps *maps); +void maps__set_e_machine(struct maps *maps, uint16_t e_machine); +#endif +#ifdef HAVE_LIBDW_SUPPORT +void *maps__libdw_addr_space_dwfl(const struct maps *maps); +void maps__set_libdw_addr_space_dwfl(struct maps *maps, void *dwfl); +#endif + +size_t maps__fprintf(struct maps *maps, FILE *fp); + +int maps__load_maps(struct maps *maps); +int maps__insert(struct maps *maps, struct map *map); +void maps__remove(struct maps *maps, struct map *map); +int maps__mutate_mapping(struct maps *maps, struct map *map, + int (*mutate_cb)(struct map *map, void *data), void *data); + +struct map *maps__find(struct maps *maps, u64 addr); +struct symbol *maps__find_symbol(struct maps *maps, u64 addr, struct map **mapp); +struct symbol *maps__find_symbol_by_name(struct maps *maps, const char *name, struct map **mapp); + +struct addr_map_symbol; + +int maps__find_ams(struct maps *maps, struct addr_map_symbol *ams); + +int maps__fixup_overlap_and_insert(struct maps *maps, struct map *new); + +struct map *maps__find_by_name(struct maps *maps, const char *name); + +struct map *maps__find_next_entry(struct maps *maps, struct map *map); + +int maps__merge_in(struct maps *kmaps, struct map *new_map); + +void maps__fixup_end(struct maps *maps); + +void maps__load_first(struct maps *maps); + +#endif // __PERF_MAPS_H -- cgit v1.3.1