diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2024-03-26 21:32:50 +0100 |
|---|---|---|
| committer | iwlwifi publisher <> | 2024-04-17 13:41:55 +0000 |
| commit | 92b3a0888344989867e6b19169917b6e10ae1ea1 (patch) | |
| tree | 32f16e724f3b2ff05606eb487a3867231194dba3 | |
| parent | 14b63a115522a9266fb6b2175a90596237fc27e9 (diff) | |
| download | backport-iwlwifi-92b3a0888344989867e6b19169917b6e10ae1ea1.tar.gz | |
[BUGFIX] wifi: mac80211: check EHT/TTLM action frame length
Check the EHT action frame length before accessing
the action code, if it's not present then the frame
cannot be valid.
type=bugfix
fixes=Ie72e47dc6f8c77d4a2f0947b775ef6367fe0edac
ticket=none
Change-Id: I71b439f016b28f65284bb7646fe36343b74cbc9a
Reported-by: syzbot+75af45a00cf13243ba39@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/0000000000006c06870614886611@google.com/
Fixes: 8f500fbc6c65 ("wifi: mac80211: process and save negotiated TID to Link mapping request")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-on: https://gerritwcs.ir.intel.com/c/iwlwifi-stack-dev/+/101450
tested: iil_jenkins iil_jenkins <EC.GER.UNIX.IIL.JENKINS@INTEL.COM>
Tested-by: iil_jenkins iil_jenkins <EC.GER.UNIX.IIL.JENKINS@INTEL.COM>
Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
(cherry picked from commit e4a33367978597a8bad042f5f560d438e92f845c)
Reviewed-on: https://gerritwcs.ir.intel.com/c/iwlwifi-stack-dev/+/101847
PerCI-Ready: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
x-iwlwifi-stack-dev: 91a3276364781c8aeb8a7bf5ae7137efe513dfba
| -rw-r--r-- | net/mac80211/rx.c | 4 | ||||
| -rw-r--r-- | versions | 2 |
2 files changed, 5 insertions, 1 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 59ee898ccc..6efe14a8e5 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -3785,6 +3785,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx) } break; case WLAN_CATEGORY_PROTECTED_EHT: + if (len < offsetofend(typeof(*mgmt), + u.action.u.ttlm_req.action_code)) + break; + switch (mgmt->u.action.u.ttlm_req.action_code) { case WLAN_PROTECTED_EHT_ACTION_TTLM_REQ: if (sdata->vif.type != NL80211_IFTYPE_STATION) @@ -2,5 +2,5 @@ BACKPORTS_VERSION="(see git)" BACKPORTED_KERNEL_VERSION="(see git)" BACKPORTED_KERNEL_NAME="iwlwifi" BACKPORTS_BUILD_TSTAMP=__DATE__ \" \" __TIME__ -BACKPORTS_GIT_TRACKED="iwlwifi-stack-public:release/core87:12048:a0cea6cb" +BACKPORTS_GIT_TRACKED="iwlwifi-stack-public:release/core87:12049:91a32763" BACKPORTS_BRANCH_TSTAMP="Apr 17 2024 13:11:40" |