projects
/
linux-block.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
50108c3
)
wifi: mac80211: check EHT/TTLM action frame length
author
Johannes Berg
<johannes.berg@intel.com>
Tue, 26 Mar 2024 20:38:58 +0000
(21:38 +0100)
committer
Johannes Berg
<johannes.berg@intel.com>
Mon, 8 Apr 2024 18:11:21 +0000
(20:11 +0200)
Check the EHT action frame length before accessing
the action code, if it's not present then the frame
cannot be valid.
Reported-by: syzbot+75af45a00cf13243ba39@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/
0000000000006c06870614886611
@google.com/
Fixes:
8f500fbc6c65
("wifi: mac80211: process and save negotiated TID to Link mapping request")
Link:
https://msgid.link/20240326213858.19c84f34349f.I71b439f016b28f65284bb7646fe36343b74cbc9a@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/rx.c
patch
|
blob
|
blame
|
history
diff --git
a/net/mac80211/rx.c
b/net/mac80211/rx.c
index c1f8501384056d3ebbb9ba7ddbd5c659c579d582..685185dc04f9700995677535ecd81f3b132ac85a 100644
(file)
--- a/
net/mac80211/rx.c
+++ b/
net/mac80211/rx.c
@@
-3780,6
+3780,10
@@
ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
}
break;
case WLAN_CATEGORY_PROTECTED_EHT:
+ if (len < offsetofend(typeof(*mgmt),
+ u.action.u.ttlm_req.action_code))
+ break;
+
switch (mgmt->u.action.u.ttlm_req.action_code) {
case WLAN_PROTECTED_EHT_ACTION_TTLM_REQ:
if (sdata->vif.type != NL80211_IFTYPE_STATION)