From nobody Fri Jul 24 22:17:37 2026 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7029C470E96 for ; Thu, 23 Jul 2026 01:10:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784769022; cv=none; b=OoOLGTj58P5xXkC9GrQsw2lk1Jwbdw4X6w+8aCeXZEA8Ivm2Yq4g+A3QLtP6z+2TIHMdloW+whq3ykVP87zTtaEDifdpLSIkdZWaWcGPkNUdAi60AVXLqMfv62aiDtrEjpzdCXsnOLbHX3jKty/+QeA25EJgblcXa5C7s3+U2TA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784769022; c=relaxed/simple; bh=SHYCWBQRYcbeMUNkhNZcYPbpD/drfADhAkDqNrEPbEo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=OxU77dOall9gtyh9g1uRScrrE4xd+ayJaa/Dxc5yI7D1n8cRW0Ag1XYHTc8fm61AQLd+X9jriqmzMl7x09e/W5yeUvzvy6DtS29pnwRysUQFlucqbKUqBpmUVnUTyRI1MB07NtozLaAdUeKn1hV9Vkw5EqDrLDlYXeqLOtc+euo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kMucKhLN; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kMucKhLN" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2ced3386430so1219625ad.1 for ; Wed, 22 Jul 2026 18:10:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784769021; x=1785373821; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=7X81Rbyibvh6xqN/yaT9IUi74PeKJQjUFG+D5wQw2cc=; b=kMucKhLN8ovOfgt9ctkB/RtC9+bsZFd6T4hGXfcWml1GFhql+crjEOA9zWOdgZvmP2 +lgd9MYLkcja7/0TYJyjc/4atolEPAZozJ7LwQfCvI7K+xuqii98BRRiYOwN/i4nAy+W 9RpN+W7Xsd0uknMbVs/hCwGAnskCWDGNCcDGjLJBJMsaNAU9pAcdmHo2aGxPUfNugZ6G YZBUjPL4NWF9TXy4TKZmus1GorBkd3Ny/cuwOghJncKKErBekOBvoZCdvU19Iv7+U7DC eUcsi0MQJ5vC+lgRDrB1WtPEFQflYYgc0VFEVNHIHKE7mJJlXthYNXhOOo4ImS+ZEwAE lFTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784769021; x=1785373821; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=7X81Rbyibvh6xqN/yaT9IUi74PeKJQjUFG+D5wQw2cc=; b=Z9tvFCivF2hYy9UwsCgoeADI6+EsYbYvg7RBb9972SRrIC+WkCSwsp7m4tgl6z27tb zQvjnNs4OQUqrkFrfDu0pUZf174vWdOYFyWLmuXJzZWMTviz100RxP+5jUI4Tgwk3r8C z7UhZOOOKubTzlERtRLR9zEX1CeXlEcRUSjZ1xLjR4zjubzcClDqMZDq0AMf/s9iezpP UsFHufgyCVUvqxwUXtw0fq9BAj05dZ9MSciRM3/tyAObLwPprFc/uSbUHju7qdr4pICn xj8AN04FyEv20VccV5e5w17b2FJFjkQYrAdP3igHp0EZQLVNKPBnEE/bAKPG8GpDrQth LT/A== X-Gm-Message-State: AOJu0YweWY6BrEyWl0ru+LStoeq4BdIPFO+VTA98GT1fGdgeKdFfP5Wi 5YK83iWvxluNaJmCmUcgH+YFb01QSdNzg7+aY2M/XyhPxYai1PAwvFse X-Gm-Gg: AR+sD105weqYtzPyzUQjQV76sUGmixdIxseJGLWEaOYCMB3Nf6Hl3hChqam8/0CyChY Cqp6g+BfyPRb+nmXhNpwyfKfpncGng64pqkQU7jR7phdw7tWMVSnTcrTgyaExgwN9bjSw8jLW7s S5aqsX5OiaE3GLjxdQBeNvwwZREXSJ56En/FN8gUs7ItdUeZlCPbe4+AO17uwUvrmH0jdjZCJu8 9YNxFKxvSkIWQoggo9CRQUmsCxZjCX0ud0WDMaxjpmivlmALMiUGaHqipdFuUBtHBO5ob0DczIx fnvscLA+iuvuMQfms5JLaHI22WSa0eazXasiDcfyyyRMGmtestKaurRT9gXy55lEeHFxeaGnpGM PvL0IQlrq+XTshRkvWslj/mZaswFWRb3itmgA1R2BdA70C+4cTIiWgro9pQOshga5WXsTbbNsMJ 3xxnOsu8KOXZEBNrk+dDqWxEnWEwW4pKs7GbXaI3O/ngaT+kMqDE4= X-Received: by 2002:a17:903:2c08:b0:2ca:d31e:ac50 with SMTP id d9443c01a7336-2cfa71d95c0mr14363935ad.17.1784769020838; Wed, 22 Jul 2026 18:10:20 -0700 (PDT) Received: from KRHW1CJW23.bytedance.net ([203.208.189.11]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf8efd828asm23053005ad.19.2026.07.22.18.10.17 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 22 Jul 2026 18:10:20 -0700 (PDT) From: Zhao Li To: linux-wireless@vger.kernel.org Cc: linux-kernel@vger.kernel.org, johannes@sipsolutions.net, briannorris@chromium.org, francesco@dolcini.it, Zhao Li , stable@vger.kernel.org Subject: [PATCH v2] wifi: mwifiex: validate action frame fixed fields Date: Thu, 23 Jul 2026 09:10:13 +0800 Message-ID: <20260723011013.76968-1-enderaoelyther@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mwifiex_process_mgmt_packet() accepts an rx_pkt_length as small as a four-address struct ieee80211_hdr plus the two-byte firmware length prefix. After stripping the prefix, mwifiex_parse_mgmt_packet() can receive a buffer equal to sizeof(struct ieee80211_hdr). For action frames, the parser reads the category immediately after that header and, for a public action frame, reads the following action code without verifying that either field is present. A minimal frame therefore reads one or two bytes beyond the RX buffer. Validate the header and require the category and public action-code fields before reading them. mwifiex parses the firmware four-address layout before removing addr4, so add ETH_ALEN to the standard IEEE80211_MIN_ACTION_SIZE() offsets. Suggested-by: Johannes Berg Fixes: 72e5aa8d2a6d ("mwifiex: support for parsing TDLS discovery frames") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/66f148d83eb9f0970b9abbccc85d1b61244e54ad.= camel@sipsolutions.net/ Link: https://lore.kernel.org/all/20260708195911.84365-8-enderaoelyther@gma= il.com/ Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li --- Changes in v2: - Add a local header check and express the action field sizes with IEEE80211_MIN_ACTION_SIZE(), accounting for the firmware layout. drivers/net/wireless/marvell/mwifiex/util.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wire= less/marvell/mwifiex/util.c index 7d3631d212236..4043590137391 100644 --- a/drivers/net/wireless/marvell/mwifiex/util.c +++ b/drivers/net/wireless/marvell/mwifiex/util.c @@ -313,13 +313,22 @@ mwifiex_parse_mgmt_packet(struct mwifiex_private *pri= v, u8 *payload, u16 len, u8 category, action_code, *addr2; struct ieee80211_hdr *ieee_hdr =3D (void *)payload; =20 + if (len < sizeof(*ieee_hdr)) + return -1; + stype =3D (le16_to_cpu(ieee_hdr->frame_control) & IEEE80211_FCTL_STYPE); =20 switch (stype) { case IEEE80211_STYPE_ACTION: + if (len < IEEE80211_MIN_ACTION_SIZE(category) + ETH_ALEN) + return -1; + category =3D *(payload + sizeof(struct ieee80211_hdr)); switch (category) { case WLAN_CATEGORY_PUBLIC: + if (len < IEEE80211_MIN_ACTION_SIZE(action_code) + ETH_ALEN) + return -1; + action_code =3D *(payload + sizeof(struct ieee80211_hdr) + 1); if (action_code =3D=3D WLAN_PUB_ACTION_TDLS_DISCOVER_RES) { --=20 2.50.1 (Apple Git-155)