From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CDA453E44E4 for ; Wed, 8 Jul 2026 20:00:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783540831; cv=none; b=rh0gsL+InTM7G3o+UK1HCSO6KqaNkJZpMvUzFxeO74mpK016+auTZ9C4rR6u7Q/UfEHNqtslzjzfkXHlkJv+2+UMbFFlEMNVR3j/YFlyUYPiLE6aG4oSbA2myahBW3CvbUv0I9xqEvbb2szAqm336ESy0o7LsvcKe/vSgH6f5Ak= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783540831; c=relaxed/simple; bh=/SAxxMsThDq0O9UGIQ5XY3LxNEdloDeHiKs04VUJlxY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bUq8G0RsyVIVyjUl/MCzWHWOQOxWZXeuSeuV9GOC982DglwS0fOQEX8v1ZqZUfDRion8zfxXB8bQzf8r9WUpEEQZRj1F0+z9Jmo0oV640cyPs1OTuyC0aI+WaYI7OxFf01o4R7/6lbeitBfIgMqtPHXOpZBfueTeDGYKc7ltj9A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JjL0JHQk; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JjL0JHQk" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-380cda7f00cso1105719a91.0 for ; Wed, 08 Jul 2026 13:00:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783540822; x=1784145622; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=A/bLDuoO7MLFyiV+1ELXwNRC5hxUInQv9JgucXzus9M=; b=JjL0JHQkr6ZSgGezlP/uJApZSanXGuYHGZR9v92JeaJvRma9PSPeLwlRgiolyvAqIa guGTG2kcSii5X8nFQdyynEkTk0KNwNzs9XcUJHgP0CmKr+tEPKrAIbYbn97jC7E1/Dw9 Z1T3snpXPJ6Rf65hRnWrAgyAFZw/mz3RblGS5FjDrDutuTlkerehtkxnuPO9PNPEUljb mBaNR6Bw7fOmmsIYFw1z9lg4vv1KExsmG18g2GYoT3aZazQoCwZT1Sry9rpCyaNn3ooM +Yyb11J0YG5hbQdJy3N4XOqbgtBtlzHsdq/cXiaspv3h5PlNSm229vWVEsxGGzomrzZZ LomA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783540822; x=1784145622; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=A/bLDuoO7MLFyiV+1ELXwNRC5hxUInQv9JgucXzus9M=; b=l/GGr/dD6vB2mo7SPYn77tXof2ziHsoijzADREVPwdp9NisMqO7c4Nnl2gA0hafwMX gu3MSY3ATEsD1sY5Prvr8MHsftrvd4tTN6utBI0Q7ZzQz7QIcxYpxlkX7D2xsQTG0qU+ hGjDxJfsEcH5olldr6m062RssiE9AExWo4/aExjPOVEJ0Wn+Lm/+2rEMfx+9OxCl4q1X Cd8zgGxbG0ChT1x3Ly2STtZ//m6M6tP9xHTpKAB9WkT7mjZAtVfz6CgeLXnVo7y4MnGL T4jT/4NXUsXuqLLQ3IqJrOch5M/xPwBFNgNXWkP/Btirl2k7+xZYPTlRrGVFlwT1uG6A Q4xA== X-Gm-Message-State: AOJu0Yw+wY27Rrqjr3JwURWLtHKD5+rCChAdZAn96/NADvfKdDtg3cXn 1347NtqdhLbKKXT6M0VBBnVHfscc2xZAV0ElEOs8e0oQQeNfNy5Q625I X-Gm-Gg: AfdE7cliPG0peft9fzzScAObO/DKpzMXzmgh9RgnVuivdPHUQaabGwRpzREGj4Jsz7W /rEGUErY4OIpY0X3eEQ3L729ah+TFExD/XHau0kIvE1BWpEDKRbObKeG00iJJAEBQ0Zb7xgvjsF ydHPK81r1smEGdzR5ekk+OKQ0a9phlkIKjJHXblAC36IRfjaPSirz3nqyqO6QdY3JCIBoZGg0za 96aNEOzQxWw9SLqLo6fwCCKIscuXxyAlDb/xGFiV+2fyAZKdhM5rmBuAGcNv4Tp45u/iij9lrlg CsWlTz1NGy45QxBJcVae6vjvZC4767ha7aqXj8nBLcPI+uRijZy32s4aG5EYR7uB3ngpnjj1I5Y GjfOGcnc1vXqFGh+ognr65pyZBIUOmWXoVjGosEgZ8NSh4MvJ041btBVyGyXufG57sHOgZpu2GM XQYoIOrDTxAWeARz4U11F4HlDuiJAU1DRqxjJ05K0bOlw8jLDUe05h X-Received: by 2002:a05:6a21:6e43:b0:3c0:adec:b3bd with SMTP id adf61e73a8af0-3c0bd19ef91mr4672746637.49.1783540822437; Wed, 08 Jul 2026 13:00:22 -0700 (PDT) Received: from KRHW1CJW23.bytedance.net ([139.177.225.228]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31174a8f521sm22585395eec.22.2026.07.08.13.00.14 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 08 Jul 2026 13:00:21 -0700 (PDT) From: Zhao Li To: linux-wireless@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Miri Korenblit , Brian Norris , Francesco Dolcini , Johannes Berg , Jaewan Kim , Daniel Gabay , Emmanuel Grumbach , Benjamin Berg , Anjaneyulu , Peddolla Harshavardhan Reddy , Lorenzo Bianconi , John Crispin , Avinash Patil , Cathy Luo , "John W. Linville" , Aloka Dixit , Zhao Li , stable@vger.kernel.org Subject: [PATCH 7/8] wifi: mwifiex: validate action frame fixed fields Date: Thu, 9 Jul 2026 03:59:10 +0800 Message-ID: <20260708195911.84365-8-enderaoelyther@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260708195911.84365-1-enderaoelyther@gmail.com> References: <20260708195911.84365-1-enderaoelyther@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit mwifiex_process_mgmt_packet() accepts an rx_pkt_length as small as a 4-address struct ieee80211_hdr plus the 2-byte firmware length prefix. After the prefix is stripped, mwifiex_parse_mgmt_packet() can be called with len equal to sizeof(struct ieee80211_hdr). For an action frame the parser then reads the category byte just past that header, and for a public action frame the action code at the next byte, without checking that len covers them. A minimal-length action frame therefore causes a one- or two-byte read past the end of the RX buffer. Reject frames shorter than the header, and require the category and (for public action frames) action-code bytes to be present before reading them. Suggested-by: Johannes Berg Fixes: 72e5aa8d2a6d ("mwifiex: support for parsing TDLS discovery frames") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/66f148d83eb9f0970b9abbccc85d1b61244e54ad.camel@sipsolutions.net/ Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li --- drivers/net/wireless/marvell/mwifiex/util.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c index 7d3631d212236..e2d76c2d9b05b 100644 --- a/drivers/net/wireless/marvell/mwifiex/util.c +++ b/drivers/net/wireless/marvell/mwifiex/util.c @@ -313,13 +313,22 @@ mwifiex_parse_mgmt_packet(struct mwifiex_private *priv, u8 *payload, u16 len, u8 category, action_code, *addr2; struct ieee80211_hdr *ieee_hdr = (void *)payload; + if (len < sizeof(*ieee_hdr)) + return -1; + stype = (le16_to_cpu(ieee_hdr->frame_control) & IEEE80211_FCTL_STYPE); switch (stype) { case IEEE80211_STYPE_ACTION: + if (len < sizeof(*ieee_hdr) + 1) + return -1; + category = *(payload + sizeof(struct ieee80211_hdr)); switch (category) { case WLAN_CATEGORY_PUBLIC: + if (len < sizeof(*ieee_hdr) + 2) + return -1; + action_code = *(payload + sizeof(struct ieee80211_hdr) + 1); if (action_code == WLAN_PUB_ACTION_TDLS_DISCOVER_RES) { -- 2.50.1 (Apple Git-155)